WAGO: Multiple Vulnerabilities
Affects WAGOSource GCVE Database
Mentioned vulnerabilities
Not known to be exploited.
Data as of 29 Oct 2026, 23:43 UTC
Rated by Threat Radar · No CVSS score from NVD or the CNA
Exploitation evidence
Disclosed: evidence found.
CVE published 3 Nov 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 29 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| WAGO GmbH & Co. KG WAGO | Affected
| Fixed in– |
AI-suggested
Users should consult WAGO's official advisories for updates and apply any forthcoming patches promptly. Until fixes are available, restrict network access to OPC UA servers and devices running CODESYS Visualizations to trusted users and networks. Limit authenticated user privileges to reduce the risk of exploitation of the SysFile component vulnerability.
Description
Multiple vulnerabilities affect WAGO devices using CODESYS components. CVE-2025-0694 involves an outdated RSA encryption scheme in the OPC UA protocol, allowing unauthenticated attackers to compromise the server's private key and bypass authentication or decrypt data. CVE-2025-1468 permits unauthenticated access to static visualization files via a web browser on devices running a Visualization. CVE-2025-2595 allows authenticated users to manipulate the SysFile component to access the local file system beyond intended directories by setting a whitelist with placeholders. These vulnerabilities impact specific WAGO device versions CC100 and 0751-9x01.