Is CVE-2022-3738 actively exploited?

No active exploitation of CVE-2022-3738 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2022-3738 be exploited remotely?

Yes. CVE-2022-3738 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2022-3738?

CVE-2022-3738 has a CVSS score of 5.9 (MEDIUM).

HOME VULNERABILITIESCVE-2022-3738

MEDIUM

CVE-2022-3738

CWE-306Published: January 19, 2023· Updated: Jun 17, 2026

5.9

CVSS v3.1

Official Description

The vulnerability allows a remote unauthenticated attacker to download a backup file, if one exists. That backup file might contain sensitive information like credentials and cryptographic material. A valid user has to create a backup after the last reboot for this attack to be successfull.

NVD Source

Technical Analysis

CVE-2022-3738 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 5.9.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorNetwork

Attack ComplexityHigh

Privileges Req.None

User InteractionNone

ScopeUnchanged

Impact

ConfidentialityHigh

IntegrityNone

AvailabilityNone

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected Vendors & Products

wago14 product(s)

pfc100 firmwarepfc100pfc200 firmwarepfc200touch panel 600 advanced firmwaretouch panel 600 advancedtouch panel 600 standard firmwaretouch panel 600 standardtouch panel 600 marine firmwaretouch panel 600 marinecc100 firmwarecc100+2

Source: NVD CPE · 14 total CPE entries