What is CVE-2023-4149?

CVE-2023-4149 is a critical-severity vulnerability in Wago 0852-0602, classified under OS Command Injection. CVSS score: 9.8/10. Published 2023-11-21.

How severe is CVE-2023-4149?

Critical severity. CVSS v3 base score is 9.8 out of 10.

RCE in Wago 0852-0602

CVE-2023-4149

A vulnerability in the web-based management allows an unauthenticated remote attacker to inject arbitrary system commands and gain full system control. Those commands are executed with root privileges. The vulnerability is located in the user request handling of the web-based management.

Vulnerability class: Command Injection (OS Command Injection)

Published 2023-11-21 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.011 (64.7th percentile), scored 2026-09-30.

Low probability of exploitation in the next 30 days, but still tracked. 65th percentile — 64.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.011 · newest: 0.011 · change: 0.000

Affected products

Wago 0852-0602
Wago 0852-0602 Firmware
Wago 0852-0603
Wago 0852-0603 Firmware
Wago 0852-1605
Wago 0852-1605 Firmware
Wago Industrial Managed Switch (0852-0602) — versions 0
Wago Industrial Managed Switch (0852-0603) — versions 0
Wago Industrial Managed Switch (0852-1605) — versions 0

Weakness classification (CWE)

CWE-78 — OS Command Injection

References

cert.vde.com/en/advisories/VDE-2023-037 (Third Party Advisory)

Frequently asked questions

What is CVE-2023-4149?: CVE-2023-4149 is a critical-severity vulnerability in Wago 0852-0602, classified under OS Command Injection. CVSS score: 9.8/10. Published 2023-11-21.
How severe is CVE-2023-4149?: Critical severity. CVSS v3 base score is 9.8 out of 10.