Summary
Several WAGO firmwares installed on different devices are impacted by various CODESYS vulnerabilities. These affect the runtime, visualization, and OPC UA server.
Details
Impact
CVE-2025-0694:
The used OPC UA protocol supports an outdated RSA encryption scheme. This allows an unauthenticated attacker to compromise the private key of the OPC UA server and bypass authentication or decrypt transmitted data.
CVE-2025-1468:
On a device with an executed Visualization an unauthenticated attacker can access static visualization files like texts or images via the web browser.
CVE-2025-2595:
Through the SysFile component (included by the CODESYS Control runtime system) an authenticated user is able to access the local file system. An authenticated attacker could use this to set a whitelist that gives access to paths inside or outside the default directory. This is possible by using placeholder similar to environmental variables.
Remediation
Update to Firmware version 04.08.01 (FW30), 03.10.11 (FW22 Patch 2) or 01.05.01. For the latest Custom Firmware please contact the WAGO support.
Vulnerabilities 3
-
High 7.5
CODESYS Control V3 - OPC UA Server Authentication bypass
An unauthenticated remote attacker can gain access to sensitive information including authentication information when using CODESYS OPC UA Server with the non-default Basic128Rsa15 security policy.
-
Medium 6.6
CODESYS Control V3 removable media path traversal
Insufficient path validation in CODESYS Control allows low privileged attackers with physical access to gain full filesystem access.
-
Medium 5.3
Forced Browsing Vulnerability in CODESYS Visualization
An unauthenticated remote attacker can bypass the user management in CODESYS Visualization and read visualization template files or static elements by means of forced browsing.
Revision history
-
#1
Release version.
References
-
WAGO PSIRT
https://www.wago.com/de-en/automation-technology/psirt
-
CERT@VDE Security Advisories for WAGO
https://certvde.com/de/advisories/vendor/wago/
-
VDE-2025-062: WAGO: Multiple Vulnerabilities in CODESYS components - HTML
https://certvde.com/en/advisories/VDE-2025-062