Skip to content
OpenAdvisories
Medium · 6.5 CVE-2025-25264 EUVD-2025-18382GHSA-rqg6-587c-h9v3

Overly Permissive CORS Policy in WAGO Device Manager

Published Jun 16, 2025 · Updated Nov 21, 2025 · Assigned by CERTVDE

Vendor: WAGO Product: CC100 0751-9x01 Product: Edge Controller 0752-8303/8000-0002 Product: PFC100 G1 0750-810x/xxxx-xxxx Product: PFC100 G2 0750-811x-xxxx-xxxx Product: PFC200 G1 750-820x-xxx-xxx Product: PFC200 G2 750-821x-xxx-xxx Product: TP600 0762-420x/8000-000x Product: TP600 0762-430x/8000-000x Product: TP600 0762-520x/8000-000x Product: TP600 0762-530x/8000-000x Product: TP600 0762-620x/8000-000x Product: TP600 0762-630x/8000-000x Category: Browsers Category: ICS / OT

Description

An unauthenticated remote attacker can trick an admin to visit a website containing malicious java script code. The current overly permissive CORS policy allows the attacker to obtain any files from the file system.

Affected products

VendorProductAffectedFixed
WAGO CC100 0751-9x01 0.0.0 – < 04.07.01 (FW29), 0.0.0 – < 04.07.01 (70 04.07.01 (FW29)
WAGO PFC100 G1 0750-810x/xxxx-xxxx 0.0.0 – < 3.10.11 (FW22 Patch 2) 3.10.11 (FW22 Patch 2)
WAGO PFC100 G2 0750-811x-xxxx-xxxx 0.0.0 – < 04.07.01 (70) 04.07.01 (70)
WAGO PFC200 G1 750-820x-xxx-xxx 0.0.0 – < 3.10.11 (FW22 Patch 2) 3.10.11 (FW22 Patch 2)
WAGO PFC200 G2 750-821x-xxx-xxx 0.0.0 – < 04.07.01 (FW29), 0.0.0 – < 04.07.01 (70) 04.07.01 (FW29)
WAGO TP600 0762-420x/8000-000x 0.0.0 – < 04.07.01 (FW29), 0.0.0 – < 04.07.01 (70) 04.07.01 (FW29)
WAGO TP600 0762-430x/8000-000x 0.0.0 – < 04.07.01 (FW29), 0.0.0 – < 04.07.01 (70) 04.07.01 (FW29)
WAGO TP600 0762-520x/8000-000x 0.0.0 – < 04.07.01 (FW29), 0.0.0 – < 04.07.01 (70) 04.07.01 (FW29)
WAGO TP600 0762-530x/8000-000x 0.0.0 – < 04.07.01 (FW29), 0.0.0 – < 04.07.01 (70) 04.07.01 (FW29)
WAGO TP600 0762-620x/8000-000x 0.0.0 – < 04.07.01 (FW29), 0.0.0 – < 04.07.01 (70) 04.07.01 (FW29)
WAGO TP600 0762-630x/8000-000x 0.0.0 – < 04.07.01 (FW29), 0.0.0 – < 04.07.01 (70) 04.07.01 (FW29)
WAGO Edge Controller 0752-8303/8000-0002 0.0.0 – < 04.07.01 (FW29), 0.0.0 – < 04.07.01 (70) 04.07.01 (FW29)

Advisories 1

References