Summary
Multiple vulnerabilities have been identified in WAGO Solution Builder and WAGO Device Sphere that affect components responsible for authentication and system communication.
Details
Impact
The identified vulnerabilities could enable unauthorized parties to gain access to protected system areas or bypass intended security controls. This may expose sensitive data and reduce overall system trustworthiness if not promptly addressed.
Remediation
Update to WAGO Device Sphere version 1.2.2. and WAGO Solution Builder version 2.4.2
Vulnerabilities 2
-
Critical 9.9
ASP.NET Security Feature Bypass Vulnerability
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.
-
High 7.5
Backend Access Due to Insufficient Input Validation
An unauthenticated remote attacker can exploit insufficient input validation to access backend components beyond their intended scope via path traversal, resulting in exposure of sensitive information.
Revision history
-
#1.0.0
Initial release.
References
-
WAGO PSIRT
https://www.wago.com/de-en/automation-technology/psirt
-
CERT@VDE Security Advisories for WAGO
https://certvde.com/de/advisories/vendor/wago/
-
VDE-2026-010: WAGO: Multiple Vulnerabilities in WAGO Solution Builder and WAGO Device Sphere - HTML
https://certvde.com/en/advisories/VDE-2026-010