This vulnerability involves improper limitation of a pathname to a restricted directory (CWE-22) in WAGO 0751-9x01. The device interprets the object name of a dynamically created BACnet File Object as a file path without sufficient validation, enabling an unauthenticated remote attacker to perform path traversal attacks. By exploiting this, the attacker can access or modify files outside the intended directory, which may result in full system compromise. The CVSS 4.0 base score is 9.3, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

An unauthenticated remote attacker can read or overwrite arbitrary files on the affected device by exploiting the path traversal vulnerability. This can lead to full system compromise, affecting confidentiality, integrity, and availability of the device and its data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict network access to the device and monitor for suspicious activity related to BACnet File Object manipulation.