Wago vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2025-41753 The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation.Critical 9.3 · Oct 1, 2026
• CVE-2026-4769 Certain devices in the WAGO System I/O Field series activate an internal diagnostic capability during the initial startup sequence.Critical 9.3 · Jul 13, 2026
• CVE-2024-1490 An authenticated remote attacker with high privileges can exploit the OpenVPN configuration via the web-based management interface of a WAGO PLC.High 7.2 · Apr 9, 2026
• CVE-2026-2328 An unauthenticated remote attacker can exploit insufficient input validation to access backend components beyond their intended scope via path traversal, resultHigh 7.5 · Mar 30, 2026
• CVE-2026-3587 An unauthenticated remote attacker can exploit a hidden function in the CLI prompt to escape the restricted interface, leading to full compromise of the device.Critical 10 · Mar 23, 2026
• CVE-2026-22906 User credentials are stored using AES‑ECB encryption with a hardcoded key.Critical 9.8 · Feb 9, 2026
• CVE-2026-22905 An unauthenticated remote attacker can bypass authentication by exploiting insufficient URI validation and using path traversal sequences (e.g., /js/../cgi-bin/High 7.5 · Feb 9, 2026
• CVE-2026-22904 Improper length handling when parsing multiple cookie fields (including TRACKID) allows an unauthenticated remote attacker to send oversized cookie values and tCritical 9.8 · Feb 9, 2026
• CVE-2026-22903 An unauthenticated remote attacker can send a crafted HTTP request containing an overly long SESSIONID cookie.Critical 9.8 · Feb 9, 2026
• CVE-2022-50926 WAGO 750-8212 PFC200 G2 2ETH RS firmware contains a privilege escalation vulnerability that allows attackers to manipulate user session cookies.High 8.7 · Jan 13, 2026
• CVE-2025-41732 An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_cookie() function to write arbitrary data into fixed-size stack buffers which Critical 9.8 · Dec 10, 2025
• CVE-2025-41730 An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_account() function to write arbitrary data into fixed-size stack buffers whichCritical 9.8 · Dec 10, 2025
• CVE-2025-41715 The database for the web application is exposed without authentication, allowing an unauthenticated remote attacker to gain unauthorized access and potentially Critical 9.8 · Sep 24, 2025
• CVE-2025-41664 A low-privileged remote attacker could gain unauthorized access to critical resources, such as firmware and certificates, due to improper permission handling duHigh 7.5 · Sep 8, 2025
• CVE-2025-41672 A remote unauthenticated attacker may use default certificates to generate JWT Tokens and gain full access to the tool and all connected devices.Critical 10 · Jul 7, 2025
• CVE-2018-25108 An unauthenticated remote attacker can cause a DoS in the controller due to uncontrolled resource consumption.High 7.5 · Jan 16, 2025
• CVE-2024-41974 A low privileged remote attacker may modify the BACNet service properties due to incorrect permission assignment for critical resources which may lead to a DoS High 7.1 · Nov 18, 2024
• CVE-2024-41973 A low privileged remote attacker can specify an arbitrary file on the filesystem which may lead to an arbitrary file writes with root privileges.High 8.1 · Nov 18, 2024
• CVE-2024-41971 A low privileged remote attacker can overwrite an arbitrary file on the filesystem leading to a DoS and data loss.High 8.1 · Nov 18, 2024
• CVE-2024-41969 A low privileged remote attacker may modify the configuration of the CODESYS V3 service through a missing authentication vulnerability which could lead to full High 8.8 · Nov 18, 2024
• CVE-2024-41967 A low privileged remote attacker may modify the boot mode configuration setup of the device, leading to modification of the firmware upgrade process or a denialHigh 8.1 · Nov 18, 2024
• CVE-2015-10123 An unautheticated remote attacker could send specifically crafted packets to a affected device.High 8.8 · Mar 13, 2024
• CVE-2023-5188 The MMS Interpreter of WagoAppRTU in versions below 1.4.6.0 which is used by the WAGO Telecontrol Configurator is vulnerable to malformed packets.High 7.5 · Dec 5, 2023
• CVE-2023-4149 A vulnerability in the web-based management allows an unauthenticated remote attacker to inject arbitrary system commands and gain full system control.Critical 9.8 · Nov 21, 2023
• CVE-2023-1150 Uncontrolled resource consumption in Series WAGO 750-3x/-8x products may allow an unauthenticated remote attacker to DoS the MODBUS server with specially crafteHigh 7.5 · Jun 26, 2023