Description
On affected Wago products an remote attacker with administrative privileges can access files to which he has already access to through an undocumented local file inclusion. This access is logged in a different log file than expected.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WAGO | Compact Controller CC100 | FW19 – ≤ FW26 | — |
| WAGO | Edge Controller | FW18 – ≤ FW26 | — |
| WAGO | PFC100 | FW16 – ≤ FW26 | — |
| WAGO | PFC200 | FW16 – ≤ FW26 | — |
| WAGO | Touch Panel 600 Advanced Line | FW16 – ≤ FW26 | — |
| WAGO | Touch Panel 600 Marine Line | FW16 – ≤ FW26 | — |
| WAGO | Touch Panel 600 Standard Line | FW16 – ≤ FW26 | — |
Advisories 2
- VDE-2023-046 WAGO: Multiple products vulnerable to local file inclusion CERT@VDE · Apr 28, 2025
- ICSA-23-325-01 WAGO PFC200 Series CISA ICS & IT advisories · Nov 21, 2023