WAGO vulnerabilities
We track 25 vulnerabilities in WAGO products across 60+ products. 25 are rated high or critical, and none are known to be exploited. The most recent was published on October 1, 2026.
Latest WAGO vulnerabilities
- 9.8 Critical severity
0751-9x01: Improper Limitation of a Pathname to a Restricted Directory
The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation. Because relative paths are not limited to the intended directory, an unauthenticated remote attacker can traverse outside of it and read or
- 9.8 Critical severity
0765-110x/0100-0000: Hidden Functionality
Certain devices in the WAGO System I/O Field series activate an internal diagnostic capability during the initial startup sequence. This functionality is not formally documented and becomes accessible without authentication for a brief period in the early boot
- 7.2 High severity
CC100 (0751-9x01): Improper Control of Generation of Code
An authenticated remote attacker with high privileges can exploit the OpenVPN configuration via the web-based management interface of a WAGO PLC. If user-defined scripts are permitted, OpenVPN may allow the execution of arbitrary shell commands enabling the at
- 7.5 High severity
Device Sphere: Improper Filtering of Special Elements
An unauthenticated remote attacker can exploit insufficient input validation to access backend components beyond their intended scope via path traversal, resulting in exposure of sensitive information.
- 10.0 Critical severity
Lean Managed Switch 852-1812: Hidden Functionality
An unauthenticated remote attacker can exploit a hidden function in the CLI prompt to escape the restricted interface, leading to full compromise of the device.
- 9.8 Critical severity
0852-1322: Use of Hard-coded Cryptographic Key
User credentials are stored using AES‑ECB encryption with a hardcoded key. An unauthenticated remote attacker obtaining the configuration file can decrypt and recover plaintext usernames and passwords, especially when combined with the authentication bypass.
- 7.5 High severity
0852-1322: Improper Limitation of a Pathname to a Restricted Directory
An unauthenticated remote attacker can bypass authentication by exploiting insufficient URI validation and using path traversal sequences (e.g., /js/../cgi-bin/post.cgi), gaining unauthorized access to protected CGI endpoints and configuration downloads.
- 9.8 Critical severity
0852-1322: Stack-based Buffer Overflow
Improper length handling when parsing multiple cookie fields (including TRACKID) allows an unauthenticated remote attacker to send oversized cookie values and trigger a stack buffer overflow, resulting in a denial‑of‑service condition and possible remote code
- 9.8 Critical severity
0852-1322: Stack-based Buffer Overflow
An unauthenticated remote attacker can send a crafted HTTP request containing an overly long SESSIONID cookie. This can trigger a stack buffer overflow in the modified lighttpd server, causing it to crash and potentially enabling remote code execution due to m
- 9.8 Critical severity
WAGO 750-8212 PFC200: Reliance on Cookies without Validation and Integrity Checking
WAGO 750-8212 PFC200 G2 2ETH RS firmware contains a privilege escalation vulnerability that allows attackers to manipulate user session cookies. Attackers can modify the cookie's 'name' and 'roles' parameters to elevate from ordinary user to administrative pri
- 9.8 Critical severity
Indsutrial-Managed-Switches: Out-of-bounds Write
An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_cookie() function to write arbitrary data into fixed-size stack buffers which leads to full device compromise.
- 9.8 Critical severity
Indsutrial-Managed-Switches: Out-of-bounds Write
An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_account() function to write arbitrary data into fixed-size stack buffers which leads to full device compromise.
- 9.8 Critical severity
Device Sphere: Missing Authentication for Critical Functionality
The database for the web application is exposed without authentication, allowing an unauthenticated remote attacker to gain unauthorized access and potentially compromise it.
- 7.5 High severity
Coupler 0750-0362: Incorrect Permission Assignment for Critical Resource
A low-privileged remote attacker could gain unauthorized access to critical resources, such as firmware and certificates, due to improper permission handling during the runtime of services (e.g., FTP/SFTP). This access could allow the attacker to escalate priv
- 7.1 High severity
CC100 0751-9x01: Incorrect Permission Assignment for Critical Resource
A low privileged remote attacker may modify the BACNet service properties due to incorrect permission assignment for critical resources which may lead to a DoS limited to BACNet communication.
- 8.8 High severity
CC100 0751-9x01: Missing Authentication for Critical Functionality
A low privileged remote attacker may modify the configuration of the CODESYS V3 service through a missing authentication vulnerability which could lead to full system access and/or DoS.
- 8.1 High severity
CC100 0751-9x01: Missing Authentication for Critical Functionality
A low privileged remote attacker may modify the boot mode configuration setup of the device, leading to modification of the firmware upgrade process or a denial-of-service attack.
- 7.5 High severity
The MMS Interpreter of WagoAppRTU in versions below 1.4.6.0 which is used by the WAGO…
The MMS Interpreter of WagoAppRTU in versions below 1.4.6.0 which is used by the WAGO Telecontrol Configurator is vulnerable to malformed packets. An remote unauthenticated attacker could send specifically crafted packets that lead to a denial-of-service condi
- 9.8 Critical severity
Industrial Managed Switch (0852-0602): Improper Neutralization of Special Elements used in an OS Command
A vulnerability in the web-based management allows an unauthenticated remote attacker to inject arbitrary system commands and gain full system control. Those commands are executed with root privileges. The vulnerability is located in the user request handling
- 7.5 High severity
750-332: Missing Release of Resource after Effective Lifetime
Uncontrolled resource consumption in Series WAGO 750-3x/-8x products may allow an unauthenticated remote attacker to DoS the MODBUS server with specially crafted packets.
- 9.8 Critical severity
Compact Controller CC100: Improper Neutralization of Special Elements used in an OS Command
In multiple products of WAGO a vulnerability allows an unauthenticated, remote attacker to create new users and change the device configuration which can result in unintended behaviour, Denial of Service and full system compromise.
- 9.8 Critical severity
Compact Controller CC100 (751-9301): Missing Authentication for Critical Functionality
The configuration backend allows an unauthenticated user to write arbitrary data with root privileges to the storage, which could lead to unauthenticated remote code execution and full system compromise.
- 9.8 Critical severity
Compact Controller CC100 (751-9301): Missing Authentication for Critical Functionality
The configuration backend of the web-based management can be used by unauthenticated users, although only authenticated users should be able to use the API. The vulnerability allows an unauthenticated attacker to read and set several device parameters that can
- 9.1 Critical severity
Unmanaged Switch 852-111/000-001: Hidden Functionality
In WAGO Unmanaged Switch (852-111/000-001) in firmware version 01 an undocumented configuration interface without authorization allows an remote attacker to read system information and configure a limited set of parameters.
- 7.5 High severity
750-81xx/xxx-xxx Series PFC100/PFC200: Expected Behavior Violation
WAGO Series PFC100/PFC200, Series Touch Panel 600, Compact Controller CC100 and Edge Controller in multiple versions are prone to a loss of MAC-Address-Filtering after reboot. This may allow an remote attacker to circumvent the reach the network that should be