CVE-2018-12981

An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware before FW 02. The vulnerability can be exploited by authenticated and unauthenticated users by sending special crafted requests to the web server allowing injecting code within the WBM. The code will be rendered and/or executed in the browser of the user's browser.

• CWE-79

• http://seclists.org/fulldisclosure/2018/Jul/38Exploit, Mailing List, Third Party Advisory
• https://cert.vde.com/en-us/advisories/vde-2018-010Third Party Advisory
• https://ics-cert.us-cert.gov/advisories/ICSA-18-198-02Third Party Advisory, US Government Resource
• https://www.exploit-db.com/exploits/45014/Exploit, Third Party Advisory, VDB Entry
• https://www.sec-consult.com/en/blog/advisories/remote-code-execution-via-multiple-attack-vectors-in-wago-edisplay/Exploit, Third Party Advisory
• https://www.wago.com/medias/SA-WBM-2018-004.pdf?context=bWFzdGVyfHJvb3R8MjgyNzYwfGFwcGxpY2F0aW9uL3BkZnxoMWUvaDg4LzkzNjE3NTIxOTUxMDIucGRmfDU1NmJkYjEzNDY0ZGU4OWQ1OTMyMjUwNTlmZTI0MzgwNDQ1MDY1YzU3OWRmZDk1NzYzODAwMDI3ODg1NDJlZjUThird Party Advisory
• http://seclists.org/fulldisclosure/2018/Jul/38Exploit, Mailing List, Third Party Advisory
• https://cert.vde.com/en-us/advisories/vde-2018-010Third Party Advisory
• https://ics-cert.us-cert.gov/advisories/ICSA-18-198-02Third Party Advisory, US Government Resource
• https://www.exploit-db.com/exploits/45014/Exploit, Third Party Advisory, VDB Entry
• https://www.sec-consult.com/en/blog/advisories/remote-code-execution-via-multiple-attack-vectors-in-wago-edisplay/Exploit, Third Party Advisory
• https://www.wago.com/medias/SA-WBM-2018-004.pdf?context=bWFzdGVyfHJvb3R8MjgyNzYwfGFwcGxpY2F0aW9uL3BkZnxoMWUvaDg4LzkzNjE3NTIxOTUxMDIucGRmfDU1NmJkYjEzNDY0ZGU4OWQ1OTMyMjUwNTlmZTI0MzgwNDQ1MDY1YzU3OWRmZDk1NzYzODAwMDI3ODg1NDJlZjUThird Party Advisory

Published

Jul 12, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-12975The random() function of the smart contract implementation f…
• CVE-2018-12976In Go Doc Dot Org (gddo) through 2018-06-27, an attacker cou…
• CVE-2018-12977A SQL injection vulnerability in the SoftExpert (SE) Excelle…
• CVE-2018-12979An issue was discovered on WAGO e!DISPLAY 762-3000 through 7…6.5
• CVE-2018-1298A Denial of Service vulnerability was found in Apache Qpid B…
• CVE-2018-12980An issue was discovered on WAGO e!DISPLAY 762-3000 through 7…8.8
• CVE-2018-12982Invalid memory read in the PoDoFo::PdfVariant::DelayedLoad()…
• CVE-2018-12983A stack-based buffer over-read in the PdfEncryptMD5Base::Com…
• CVE-2018-12984Hycus CMS 1.0.4 allows Authentication Bypass via "'=' 'OR'" …
• CVE-2018-12988GreenCMS 2.3.0603 has an arbitrary file download vulnerabili…
• CVE-2018-12989The report-viewing feature in Pearson VUE Certiport Console …
• CVE-2018-1299In Apache Allura before 1.8.0, unauthenticated attackers may…