CVE-2025-41753 is a critical path traversal vulnerability in the WAGO 0751-9x01 device. The vulnerability arises because the object name of a dynamically created BACnet File Object is used as a file path without proper validation. This allows an unauthenticated remote attacker to traverse directories outside the intended restricted directory and read or overwrite arbitrary files on the device. Exploitation could lead to full system compromise.
Certain devices in the WAGO System I/O Field series activate an internal diagnostic capability during the initial startup sequence. This functionality is not formally documented and becomes accessible without authentication for a brief period in the early boot phase. During this window, an unauthenticated remote attacker can gain access to the internal system processes, resulting in full system compromise.
CVE-2024-1490 is a high-severity vulnerability in the WAGO CC100 (0751-9x01) PLC that allows an authenticated remote attacker with high privileges to execute arbitrary shell commands via the OpenVPN configuration accessible through the device's web-based management interface. This occurs if user-defined scripts are permitted, enabling code injection through improper control of code generation. The vulnerability has a CVSS score of 7.2, indicating significant impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
CVE-2026-2328 is a high-severity vulnerability in WAGO Device Sphere that allows an unauthenticated remote attacker to perform path traversal due to improper input validation. This flaw enables access to backend components beyond their intended scope, potentially exposing sensitive information. The vulnerability does not require user interaction or privileges to exploit. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.
CVE-2026-3587 is a critical vulnerability in the WAGO Lean Managed Switch 852-1812 that allows an unauthenticated remote attacker to exploit a hidden CLI function to escape the restricted interface. This leads to full device compromise, including complete control over confidentiality, integrity, and availability. The vulnerability requires no authentication or user interaction and can be exploited remotely with low complexity. Although no known exploits are currently in the wild, the CVSS score of 10 reflects its severe impact and ease of exploitation. Organizations using this switch model are at high risk of network disruption and potential lateral movement by attackers. Immediate mitigation involves isolating affected devices and applying vendor patches once available. Countries with significant industrial automation and critical infrastructure deployments of WAGO products are most at risk. Defenders must prioritize detection of unauthorized CLI access attempts and restrict network exposure of management interfaces to trusted zones only.
CVE-2026-22906 is a critical vulnerability in the WAGO 0852-1322 device where user credentials are encrypted using AES-ECB with a hardcoded cryptographic key. An unauthenticated remote attacker who obtains the device's configuration file can decrypt and recover plaintext usernames and passwords. This vulnerability allows full compromise of confidentiality, integrity, and availability without requiring authentication or user interaction. The weakness stems from the use of a static, hardcoded key combined with the insecure AES-ECB mode, which is susceptible to cryptanalysis. Although no exploits are currently known in the wild, the high CVSS score of 9.8 reflects the ease of exploitation and severe impact. European organizations using WAGO 0852-1322 devices, especially in industrial automation and critical infrastructure, are at significant risk. Immediate mitigation involves restricting access to configuration files, monitoring for unauthorized access, and applying vendor patches once available. Countries with extensive industrial automation deployments, such as Germany, France, and the Netherlands, are most likely to be affected due to WAGO’s market presence and critical infrastructure reliance.
CVE-2026-22905 is a high-severity path traversal vulnerability in the WAGO 0852-1322 device that allows unauthenticated remote attackers to bypass authentication by exploiting insufficient URI validation. Attackers can use path traversal sequences to access protected CGI endpoints and download sensitive configuration files without authorization. This vulnerability does not require user interaction or privileges and can be exploited remotely over the network. While no known exploits are currently reported in the wild, the impact on confidentiality is significant as attackers can access sensitive data. The vulnerability affects all versions of the product as identified. European organizations using WAGO 0852-1322 devices, especially in critical infrastructure sectors, are at risk. Mitigation requires strict URI validation, patching by the vendor, and network-level protections such as segmentation and access controls. Countries with high industrial automation adoption and critical infrastructure reliance on WAGO products are most likely to be affected.
CVE-2026-22904 is a critical stack-based buffer overflow vulnerability in the WAGO 0852-1322 device caused by improper length handling when parsing multiple cookie fields, including TRACKID. An unauthenticated remote attacker can exploit this by sending oversized cookie values, leading to denial-of-service or potential remote code execution. The vulnerability has a CVSS score of 9.8, indicating high severity with no authentication or user interaction required. No known exploits are currently reported in the wild. European organizations using WAGO 0852-1322 controllers, especially in industrial automation sectors, are at significant risk. Mitigation requires immediate vendor patching once available and network-level protections to restrict access to affected devices. Countries with strong industrial automation presence such as Germany, France, and Italy are most likely to be impacted.
CVE-2026-22903 is a critical stack-based buffer overflow vulnerability in the WAGO 0852-1322 device's modified lighttpd server. An unauthenticated remote attacker can exploit this by sending an HTTP request with an excessively long SESSIONID cookie, causing the server to crash and potentially allowing remote code execution. The vulnerability arises due to missing stack protections, making exploitation easier and more impactful. This flaw affects the availability, integrity, and confidentiality of the device and connected systems. No patches are currently available, and no known exploits are reported in the wild yet. European organizations using WAGO 0852-1322 devices, especially in industrial automation and control systems, are at high risk. Mitigation requires network-level protections, strict input validation, and monitoring for anomalous HTTP requests. Countries with significant industrial automation sectors and WAGO market presence, such as Germany, France, and the Netherlands, are most likely to be affected. Given the critical CVSS score of 9.8, immediate attention and proactive defense measures are essential to prevent exploitation.
An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_cookie() function to write arbitrary data into fixed-size stack buffers which leads to full device compromise.
An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_account() function to write arbitrary data into fixed-size stack buffers which leads to full device compromise.
The web application allows an unauthenticated remote attacker to learn information about existing user accounts with their corresponding role due to missing authentication for critical function.
The database for the web application is exposed without authentication, allowing an unauthenticated remote attacker to gain unauthorized access and potentially compromise it.
During a short time frame while the device is booting an unauthenticated remote attacker can send traffic to unauthorized networks due to the switch operating in an undefined state until a CPU-induced reset allows proper configuration.
A low-privileged remote attacker could gain unauthorized access to critical resources, such as firmware and certificates, due to improper permission handling during the runtime of services (e.g., FTP/SFTP). This access could allow the attacker to escalate privileges and modify firmware.
A web application for configuring the controller is accessible at a specific path. It contains an endpoint that allows a high privileged remote attacker to read files from the system’s file structure.
An unauthenticated remote attacker can trick an admin to visit a website containing malicious java script code. The current overly permissive CORS policy allows the attacker to obtain any files from the file system.
A low privileged attacker can set the date of the devices to the 19th of January 2038 an therefore exceed the 32-Bit time limit. This causes the date of the switch to be set back to January 1st, 1970.
The WAGO Year 2038 problem is a vulnerability affecting certain WAGO devices, specifically models CC100 and 0751-9x01. It may cause some functions to behave unexpectedly or cease functioning both during runtime and after a restart. This issue relates to the well-known Year 2038 problem, which involves integer overflow in time representations. No CVSS score is available for this vulnerability.
