Vendor
WAGO
99 known vulnerabilities.
WAGO at a glance
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 0 | 0 |
| Oct 2026 | 1 | 1 |
| Sep 2026 | 0 | 0 |
| Aug 2026 | 0 | 0 |
| Jul 2026 | 1 | 1 |
| Jun 2026 | 0 | 0 |
| May 2026 | 0 | 0 |
| Apr 2026 | 2 | 0 |
| Mar 2026 | 2 | 1 |
| Feb 2026 | 4 | 3 |
| Jan 2026 | 1 | 1 |
| Dec 2025 | 2 | 2 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 4 | 1 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 1 | 1 |
| Jun 2025 | 3 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 1 | 0 |
| Mar 2025 | 1 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 1 | 0 |
| Dec 2024 | 0 | 0 |
Products
Latest advisories
-
Critical max 10.0
WAGO GmbH & Co. KG Industrial Managed Switches
A vulnerability has been found affecting the Managed Switches of WAGO. An unauthenticated attacker can fully compromise the device via an undocumented function.
first Mar 23, 2026 -
Critical
WAGO Ethernet Web-based Management Authentication Bypass Vulnerability
first Sep 25, 2016 -
Criticalfirst Jun 9, 2012
-
Low max 2.7ICSA-23-325-01 1 CVE
WAGO PFC200 Series
Successful exploitation of this vulnerability could allow an attacker with administrative privileges can access sensitive files in an unintended, undocumented way.
-
High max 7.5
WAGO Series 750-88x and 750-352 (Update A)
Successful exploitation of this vulnerability could allow an attacker to crash the device being accessed using a denial-of-service attack.
first Nov 3, 2020
99 results · Feed
-
Critical 9.8
Path traversal in dynamically created BACnet File Objects
The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation. Because relative paths are not limited to the intended directory, an unauthenticated remote attacker can traverse outside of it and read o…
-
Critical 9.8
Unauthenticated Access to Internal Diagnostic Interface
Certain devices in the WAGO System I/O Field series activate an internal diagnostic capability during the initial startup sequence. This functionality is not formally documented and becomes accessible without authentication for a brief period in the early boo…
-
Medium 4.3
Wago: Vulnerability in Smart Designer Web-Application
In Wago Smart Designer in versions up to 2.33.1 a low privileged remote attacker may enumerate projects and usernames through iterative requests to an specific endpoint.
-
High 7.2
Wago: Vulnerability in WBM through Open VPN
An authenticated remote attacker with high privileges can exploit the OpenVPN configuration via the web-based management interface of a WAGO PLC. If user-defined scripts are permitted, OpenVPN may allow the execution of arbitrary shell commands enabling the a…
-
High 7.5
Backend Access Due to Insufficient Input Validation
An unauthenticated remote attacker can exploit insufficient input validation to access backend components beyond their intended scope via path traversal, resulting in exposure of sensitive information.
-
Critical 10.0
Hidden CLI Function Allows Root Access
An unauthenticated remote attacker can exploit a hidden function in the CLI prompt to escape the restricted interface, leading to full compromise of the device.
-
Critical 9.8
Hardcoded Key Allows Credential Disclosure
User credentials are stored using AES‑ECB encryption with a hardcoded key. An unauthenticated remote attacker obtaining the configuration file can decrypt and recover plaintext usernames and passwords, especially when combined with the authentication bypass.
-
High 7.5
Authentication Bypass via URI Traversal
An unauthenticated remote attacker can bypass authentication by exploiting insufficient URI validation and using path traversal sequences (e.g., /js/../cgi-bin/post.cgi), gaining unauthorized access to protected CGI endpoints and configuration downloads.
-
Critical 9.8
Stack Overflow via Oversized Cookie Fields in lighttpd
Improper length handling when parsing multiple cookie fields (including TRACKID) allows an unauthenticated remote attacker to send oversized cookie values and trigger a stack buffer overflow, resulting in a denial‑of‑service condition and possible remote code…
-
Critical 9.8
Stack Overflow via SESSIONID Cookie in lighttpd
An unauthenticated remote attacker can send a crafted HTTP request containing an overly long SESSIONID cookie. This can trigger a stack buffer overflow in the modified lighttpd server, causing it to crash and potentially enabling remote code execution due to …
-
Critical 9.8
WAGO 750-8212 PFC200 G2 2ETH RS Privilege Escalation
WAGO 750-8212 PFC200 G2 2ETH RS firmware contains a privilege escalation vulnerability that allows attackers to manipulate user session cookies. Attackers can modify the cookie's 'name' and 'roles' parameters to elevate from ordinary user to administrative pr…
-
Critical 9.8
Stack-based buffer overflow via unsafe sscanf in check_cookie()
An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_cookie() function to write arbitrary data into fixed-size stack buffers which leads to full device compromise.
-
Critical 9.8
Stack-based buffer overflow via unsafe sscanf in check_account()
An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_account() function to write arbitrary data into fixed-size stack buffers which leads to full device compromise.
-
Medium 5.3
Unauthenticated User Enumeration via Missing Authentication
The web application allows an unauthenticated remote attacker to learn information about existing user accounts with their corresponding role due to missing authentication for critical function.
-
Critical 9.8
Missing Authentication for Database Access in Web Application
The database for the web application is exposed without authentication, allowing an unauthenticated remote attacker to gain unauthorized access and potentially compromise it.
-
Medium 6.5
WAGO: Vulnerability in hardware switch circuit
During a short time frame while the device is booting an unauthenticated remote attacker can send traffic to unauthorized networks due to the switch operating in an undefined state until a CPU-induced reset allows proper configuration.
-
High 7.5
Improper Permission Handling Enables Unauthorized Access to Firmware and Certificates
A low-privileged remote attacker could gain unauthorized access to critical resources, such as firmware and certificates, due to improper permission handling during the runtime of services (e.g., FTP/SFTP). This access could allow the attacker to escalate pri…
-
Critical 10.0
WAGO: Vulnerability in WAGO Device Sphere
A remote unauthenticated attacker may use default certificates to generate JWT Tokens and gain full access to the tool and all connected devices.
-
Medium 4.9
Unauthenticated File Read via Web Interface
A web application for configuring the controller is accessible at a specific path. It contains an endpoint that allows a high privileged remote attacker to read files from the system’s file structure.
-
Medium 6.5
Overly Permissive CORS Policy in WAGO Device Manager
An unauthenticated remote attacker can trick an admin to visit a website containing malicious java script code. The current overly permissive CORS policy allows the attacker to obtain any files from the file system.
-
Medium 4.3
WAGO: Switches affected by year 2k38 problem
A low privileged attacker can set the date of the devices to the 19th of January 2038 an therefore exceed the 32-Bit time limit. This causes the date of the switch to be set back to January 1st, 1970.
-
Medium 6.5
WAGO: Year 2038 problem
A low privileged user can set the date of the devices to the 19th of January 2038 an therefore exceed the 32-Bit time limit. This causes some functions to work unexpected or stop working at all. Both during runtime and after a restart.
-
Medium 5.4
Wago: Vulnerability in libwagosnmp
An attacker with low privileges can manipulate the requested memory size, causing the application to use an invalid memory area. This could lead to a crash of the application but it does not affected other applications.
-
High 7.5
WAGO: Denial of service in 750-8xx controller due to uncontrolled resource consumption
An unauthenticated remote attacker can cause a DoS in the controller due to uncontrolled resource consumption.
-
High 7.1
WAGO: BACNet Service Property Modification Due to Permission Misconfiguration in Multiple Devices
A low privileged remote attacker may modify the BACNet service properties due to incorrect permission assignment for critical resources which may lead to a DoS limited to BACNet communication.
-
High 8.1
WAGO: Remote Arbitrary File Write with Root Privileges in multiple Devices
A low privileged remote attacker can specify an arbitrary file on the filesystem which may lead to an arbitrary file writes with root privileges.
-
Medium 6.5
WAGO: Arbitrary File Overwrite Leading to Privileged File Read in Multiple Devices
A low privileged remote attacker can overwrite an arbitrary file on the filesystem which may lead to an arbitrary file read with root privileges.
-
High 8.1
WAGO: Arbitrary File Overwrite in Multiple Devices
A low privileged remote attacker can overwrite an arbitrary file on the filesystem leading to a DoS and data loss.
-
Medium 5.7
WAGO: Unauthorized Diagnostic Data Exposure in Multiple Devices
A low privileged remote attacker may gain access to forbidden diagnostic data due to incorrect permission assignment for critical resources.
-
High 8.8
WAGO: CODESYS V3 Configuration Authentication Bypass in Multiple Devices
A low privileged remote attacker may modify the configuration of the CODESYS V3 service through a missing authentication vulnerability which could lead to full system access and/or DoS.
-
High 8.1
WAGO: Boot Mode Manipulation in Multiple Devices
A low privileged remote attacker may modify the boot mode configuration setup of the device, leading to modification of the firmware upgrade process or a denial-of-service attack.
-
Medium 5.4
WAGO: Docker Settings Manipulation in Multiple Devices
A low privileged remote attacker may modify the docker settings setup of the device, leading to a limited DoS.
-
Medium 5.4
Wago: Improper Neutralization of Input During Web Page Generation in multiple devices
An unauthenticated remote attacker can use an XSS attack due to improper neutralization of input during web page generation. User interaction is required. This leads to a limited impact of confidentiality and integrity but no impact of availability.
-
High 8.8
Wago: Buffer Copy without Checking Size of Input in wbm of multiple products
An unautheticated remote attacker could send specifically crafted packets to a affected device. If an authenticated user then views that data in a specific page of the web-based management a buffer overflow will be triggered to gain full access of the device.
-
High 7.5
WAGO Improper Input Validation in IEC61850 Server / Telecontrol
The MMS Interpreter of WagoAppRTU in versions below 1.4.6.0 which is used by the WAGO Telecontrol Configurator is vulnerable to malformed packets. An remote unauthenticated attacker could send specifically crafted packets that lead to a denial-of-service cond…
-
Critical 9.8
WAGO: OS Command Injection Vulnerability in Managed Switch
A vulnerability in the web-based management allows an unauthenticated remote attacker to inject arbitrary system commands and gain full system control. Those commands are executed with root privileges. The vulnerability is located in the user request handling…
-
Medium 5.3
WAGO: Improper Privilege Management in web-based management
Wago web-based management of multiple products has a vulnerability which allows an local authenticated attacker to change the passwords of other non-admin users and thus to escalate non-root privileges.
-
Low 2.7
WAGO: Multiple products vulnerable to local file inclusion
On affected Wago products an remote attacker with administrative privileges can access files to which he has already access to through an undocumented local file inclusion. This access is logged in a different log file than expected.
-
High 7.5
WAGO: Series 750-3x/-8x prone to MODBUS server DoS
Uncontrolled resource consumption in Series WAGO 750-3x/-8x products may allow an unauthenticated remote attacker to DoS the MODBUS server with specially crafted packets.
-
Medium 4.9
WAGO: DoS in multiple products in multiple versions using Codesys
Multiple WAGO devices in multiple versions may allow an authenticated remote attacker with high privileges to DoS the device by sending a specifically crafted packet to the CODESYS V2 runtime.