Summary
The base ctrlX OS apps Device Admin and Solutions contain multiple vulnerabilities. In a worst case scenario, a remote authenticated (low-privileged) attacker might be able to execute arbitrary OS commands running with higher privileges.
Details
Impact
This could lead to an escalation of privileges and give an attacker full access to the device.
Remediation
Update the following components:
* Update Device Admin to version 2.6.9
* Update Solutions to version 2.6.1
Vulnerabilities 15
-
High 8.8
A vulnerability in the “Remote Logging” functionality of the web application of ctrlX OS allows a remote authenticated …
-
High 7.5
A vulnerability in the “Proxy” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivi…
-
High 7.1
A vulnerability in the “Manages app data” functionality of the web application of ctrlX OS allows a remote authenticate…
-
High 7.1
A vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authentica…
-
High 7.1
A vulnerability in the “Certificates and Keys” functionality of the web application of ctrlX OS allows a remote authent…
-
Medium 6.5
A vulnerability in the users configuration file of ctrlX OS may allow a remote authenticated (low-privileged) attacker …
-
Medium 6.5
A vulnerability in the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to induce a …
-
Medium 6.5
A vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authentica…
-
Medium 6.5
A vulnerability in the “Backup & Restore” functionality of the web application of ctrlX OS allows a remote authenticate…
-
Medium 6.3
A vulnerability in the error notification messages of the web application of ctrlX OS allows a remote unauthenticated a…
-
Medium 6.3
A vulnerability in the “Hosts” functionality of the web application of ctrlX OS allows a remote authenticated (low-priv…
-
Medium 5.4
A vulnerability in the “Manages app data” functionality of the web application of ctrlX OS allows a remote authenticate…
-
Medium 5.4
A vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authentica…
-
Medium 5.3
A vulnerability in the login functionality of the web application of ctrlX OS allows a remote unauthenticated attacker …
-
Medium 5.0
A vulnerability in the web application of ctrlX OS allows a remote unauthenticated attacker to conduct various attacks …
Revision history
-
#1
Initial release.
References
-
WAGO PSIRT
https://www.wago.com/de-en/automation-technology/psirt
-
CERT@VDE Security Advisories for WAGO
https://certvde.com/de/advisories/vendor/wago/
-
VDE-2025-040: WAGO: Vulnerabilities in ctrlX OS app - HTML
https://certvde.com/en/advisories/VDE-2025-040
-
BOSCH-SA-640452: Multiple ctrlX OS vulnerabilities
https://psirt.bosch.com/security-advisories/bosch-sa-640452.html