VDE-2025-057 — WAGO: Vulnerability in WAGO Device Sphere

Summary

During installation, identical certificates are installed across all systems instead of unique ones, which are intended for JWT Token encryption and signing.

Details

Impact
The system installs identical JWT signing certificates on all installations instead of generating unique ones. This allows anyone with the shared key to forge valid tokens and impersonate users across all systems, compromising security.

Remediation
Update to WAGO Device Sphere version 1.0.1. WAGO Device Sphere version 1.0 can't be used after the 30.06.2025.

Vulnerabilities 1

Critical 10.0

CVE-2025-41672

WAGO: Vulnerability in WAGO Device Sphere

A remote unauthenticated attacker may use default certificates to generate JWT Tokens and gain full access to the tool and all connected devices.

WAGO Wago Device Sphere ICS / OT

Jul 7, 2025

Revision history

2025-07-07 #1.0.1
fixed typo in CVE-ID
2025-06-12 #1.0.0
Initial release.

References

WAGO PSIRT
https://www.wago.com/de-en/automation-technology/psirt
CERT@VDE Security Advisories for WAGO
https://certvde.com/de/advisories/vendor/wago/
VDE-2025-057: WAGO: Vulnerability in WAGO Device Sphere - HTML
https://certvde.com/en/advisories/VDE-2025-057