Skip to content
OpenAdvisories
Critical VDE-2025-087 2 CVEs

WAGO: Vulnerabilities in Device Sphere and Solution Builder

Published Sep 24, 2025 · Updated Sep 24, 2025

Vendor: WAGO Product: Device Sphere Product: Solution Builder

Summary

Due to a missing authentication check, the WAGO Solution Builder and the WAGO Device Sphere are vulnerable to a potential information exposure.

Details

Impact
Exposing database credentials gives attackers direct database access, leading to data loss, theft or manipulation. Exposing user accounts and roles facilitates targeted attacks like brute-force or social engineering, increasing the risk of compromising privileged accounts.

Remediation
Please upgrade to the specified version or a later one of the WAGO Device Sphere or the WAGO Solution Builder.

| Affected Product | Fixed Version |
| -------- | ------- |
| WAGO Software Device Sphere | 1.1.0 |
| WAGO Software Solution Builder | 2.3.3 |

Vulnerabilities 2

  • Critical 9.8
    CVE-2025-41715

    Missing Authentication for Database Access in Web Application

    The database for the web application is exposed without authentication, allowing an unauthenticated remote attacker to gain unauthorized access and potentially compromise it.

    WAGO Solution Builder Device Sphere ICS / OT
  • Medium 5.3
    CVE-2025-41716

    Unauthenticated User Enumeration via Missing Authentication

    The web application allows an unauthenticated remote attacker to learn information about existing user accounts with their corresponding role due to missing authentication for critical function.

    WAGO Solution Builder ICS / OT

Revision history

  1. #1.0.0

    Initial Release.

References