VDE-2024-008 — Wago: Vulnerability in WBM through Open VPN

Summary

A security vulnerability has been identified in the Web-Based Management (WBM) function when OpenVPN is enabled.

Details

Impact
An authenticated attacker with high privileges can execute arbitrary shell commands on the affected device, potentially leading to full system compromise.

Mitigation
The user is able to drop privileges of OpenVPN. How to do this is described in the Manual "Cyber Security for Controller PFC100 / PFC200" at section 7.1.4. and in the product manual.

Vulnerabilities 1

High 7.2

CVE-2024-1490

Wago: Vulnerability in WBM through Open VPN

An authenticated remote attacker with high privileges can exploit the OpenVPN configuration via the web-based management interface of a WAGO PLC. If user-defined scripts are permitted, OpenVPN may allow the execution of arbitrary shell commands enabling the a…

WAGO TP600 0762-430x/8000-000x TP600 0762-530x/8000-000x TP600 0762-630x/8000-000x Browsers ICS / OT

Apr 9, 2026

Revision history

2026-04-08 #1.0.0
Initial Release.

References

WAGO PSIRT
https://www.wago.com/de-en/automation-technology/psirt
CERT@VDE Security Advisories for WAGO
https://certvde.com/de/advisories/vendor/wago/
VDE-2024-008: Wago: Vulnerability in WBM through Open VPN - HTML
https://certvde.com/en/advisories/VDE-2024-008