Skip to content
OpenAdvisories
High VDE-2025-008 1 CVE

WAGO: Vulnerabilities in CODESYS Control

Published Feb 4, 2025 · Updated May 14, 2025 · Revision 3

Vendor: WAGO Product: 0750-810x/xxxx-xxxx Product: 0750-811x-xxxx-xxxx Product: 0750-820x/xxx-xxx Product: 0750-821x-xxx-xxx Product: 0751-9x01 Product: 0752-8303-8000-0002 Product: 0762-420x-8000-000x Product: 0762-430x-8000-000x Product: 0762-520x-8000-000x Product: 0762-530x-8000-000x Product: 0762-620x-8000-000x Product: 0762-630x-8000-000x

Summary

The following firmware versions installed on several devices are are vulnerable due to a vulnerability in CODESYS Control.

Details

Impact
The CODESYS Control runtime system allows devices to function as programmable industrial controllers, accessing IOs, communication interfaces, and system functions. An authenticated attacker could exploit a vulnerability to inject OS shell function calls via the SysFile or CAA file system libraries.

Remediation
Update to Firmware version 27, Firmware 22 Patch 2. For the latest Custom Firmware version please contact the WAGO support.

Mitigation
The vulnerability is only exploitable if the an attacker has successfully logged in with according user rights. To prevent attackers from exploiting the vulnerability it is recommend to change the standard password in the web based management.

Vulnerabilities 1

Revision history

  1. #3

    Fix: added distribution

  2. #2

    Update: fixed typo in Vendor fix, fixed version

  3. #1

    Initial release.

References