Wago
106 CVEs across 575 Wago products. Browse Wago vulnerabilities, severities, and proof-of-concept exploits.
Wago products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-4769 | Critical | 9.8 | 2026-07-13 | Certain devices in the WAGO System I/O Field series activate an internal diagnostic capability during the initial startup sequence. This functionality is not f… |
CVE-2023-5872 | Medium | 4.3 | 2026-04-16 | In Wago Smart Designer in versions up to 2.33.1 a low privileged remote attacker may enumerate projects and usernames through iterative requests to an specific… |
CVE-2024-1490 | High | 7.2 | 2026-04-09 | An authenticated remote attacker with high privileges can exploit the OpenVPN configuration via the web-based management interface of a WAGO PLC. If user-defin… |
CVE-2026-2328 | High | 7.5 | 2026-03-30 | An unauthenticated remote attacker can exploit insufficient input validation to access backend components beyond their intended scope via path traversal, resul… |
CVE-2026-3587 | Critical | 10.0 | 2026-03-23 | An unauthenticated remote attacker can exploit a hidden function in the CLI prompt to escape the restricted interface, leading to full compromise of the device. |
CVE-2026-22906 | Critical | 9.8 | 2026-02-09 | User credentials are stored using AES‑ECB encryption with a hardcoded key. An unauthenticated remote attacker obtaining the configuration file can decrypt and… |
CVE-2026-22905 | High | 7.5 | 2026-02-09 | An unauthenticated remote attacker can bypass authentication by exploiting insufficient URI validation and using path traversal sequences (e.g., /js/../cgi-bin… |
CVE-2026-22904 | Critical | 9.8 | 2026-02-09 | Improper length handling when parsing multiple cookie fields (including TRACKID) allows an unauthenticated remote attacker to send oversized cookie values and… |
CVE-2026-22903 | Critical | 9.8 | 2026-02-09 | An unauthenticated remote attacker can send a crafted HTTP request containing an overly long SESSIONID cookie. This can trigger a stack buffer overflow in the… |
CVE-2022-50926 | Critical | 9.8 | 2026-01-13 | WAGO 750-8212 PFC200 G2 2ETH RS firmware contains a privilege escalation vulnerability that allows attackers to manipulate user session cookies. Attackers can… |
CVE-2025-41732 | Critical | 9.8 | 2025-12-10 | An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_cookie() function to write arbitrary data into fixed-size stack buffers which… |
CVE-2025-41730 | Critical | 9.8 | 2025-12-10 | An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_account() function to write arbitrary data into fixed-size stack buffers whic… |
CVE-2025-41716 | Medium | 5.3 | 2025-09-24 | The web application allows an unauthenticated remote attacker to learn information about existing user accounts with their corresponding role due to missing au… |
CVE-2025-41715 | Critical | 9.8 | 2025-09-24 | The database for the web application is exposed without authentication, allowing an unauthenticated remote attacker to gain unauthorized access and potentially… |
CVE-2025-41713 | Medium | 6.5 | 2025-09-15 | During a short time frame while the device is booting an unauthenticated remote attacker can send traffic to unauthorized networks due to the switch operating… |
CVE-2025-41664 | High | 7.5 | 2025-09-08 | A low-privileged remote attacker could gain unauthorized access to critical resources, such as firmware and certificates, due to improper permission handling d… |
CVE-2025-41672 | Critical | 10.0 | 2025-07-07 | A remote unauthenticated attacker may use default certificates to generate JWT Tokens and gain full access to the tool and all connected devices. |
CVE-2025-25265 | Medium | 4.9 | 2025-06-16 | A web application for configuring the controller is accessible at a specific path. It contains an endpoint that allows a high privileged remote attacker to rea… |
CVE-2025-25264 | Medium | 6.5 | 2025-06-16 | An unauthenticated remote attacker can trick an admin to visit a website containing malicious java script code. The current overly permissive CORS policy allow… |
CVE-2025-1235 | Medium | 4.3 | 2025-06-02 | A low privileged attacker can set the date of the devices to the 19th of January 2038 an therefore exceed the 32-Bit time limit. This causes the date of the sw… |
CVE-2025-0101 | Medium | 6.5 | 2025-04-16 | A low privileged user can set the date of the devices to the 19th of January 2038 an therefore exceed the 32-Bit time limit. This causes some functions to work… |
CVE-2024-12650 | Medium | 5.4 | 2025-03-05 | An attacker with low privileges can manipulate the requested memory size, causing the application to use an invalid memory area. This could lead to a crash of… |
CVE-2018-25108 | High | 7.5 | 2025-01-16 | An unauthenticated remote attacker can cause a DoS in the controller due to uncontrolled resource consumption. |
CVE-2024-41974 | High | 7.1 | 2024-11-18 | A low privileged remote attacker may modify the BACNet service properties due to incorrect permission assignment for critical resources which may lead to a DoS… |
CVE-2024-41973 | High | 8.1 | 2024-11-18 | A low privileged remote attacker can specify an arbitrary file on the filesystem which may lead to an arbitrary file writes with root privileges. |
CVE-2024-41972 | Medium | 6.5 | 2024-11-18 | A low privileged remote attacker can overwrite an arbitrary file on the filesystem which may lead to an arbitrary file read with root privileges. |
CVE-2024-41971 | High | 8.1 | 2024-11-18 | A low privileged remote attacker can overwrite an arbitrary file on the filesystem leading to a DoS and data loss. |
CVE-2024-41970 | Medium | 5.7 | 2024-11-18 | A low privileged remote attacker may gain access to forbidden diagnostic data due to incorrect permission assignment for critical resources. |
CVE-2024-41969 | High | 8.8 | 2024-11-18 | A low privileged remote attacker may modify the configuration of the CODESYS V3 service through a missing authentication vulnerability which could lead to full… |
CVE-2024-41968 | Medium | 5.4 | 2024-11-18 | A low privileged remote attacker may modify the docker settings setup of the device, leading to a limited DoS. |
CVE-2024-41967 | High | 8.1 | 2024-11-18 | A low privileged remote attacker may modify the boot mode configuration setup of the device, leading to modification of the firmware upgrade process or a denia… |
CVE-2018-25090 | Medium | 5.4 | 2024-03-13 | An unauthenticated remote attacker can use an XSS attack due to improper neutralization of input during web page generation. User interaction is required. This… |
CVE-2015-10123 | High | 8.8 | 2024-03-13 | An unautheticated remote attacker could send specifically crafted packets to a affected device. If an authenticated user then views that data in a specific pag… |
CVE-2023-5188 | High | 7.5 | 2023-12-05 | The MMS Interpreter of WagoAppRTU in versions below 1.4.6.0 which is used by the WAGO Telecontrol Configurator is vulnerable to malformed packets. An remote un… |
CVE-2023-4149 | Critical | 9.8 | 2023-11-21 | A vulnerability in the web-based management allows an unauthenticated remote attacker to inject arbitrary system commands and gain full system control. Those c… |
CVE-2023-3379 | Medium | 5.3 | 2023-11-20 | Wago web-based management of multiple products has a vulnerability which allows an local authenticated attacker to change the passwords of other non-admin use… |
CVE-2023-4089 | Low | 2.7 | 2023-10-17 | On affected Wago products an remote attacker with administrative privileges can access files to which he has already access to through an undocumented local fi… |
CVE-2023-1620 | Medium | 4.9 | 2023-06-26 | Multiple WAGO devices in multiple versions may allow an authenticated remote attacker with high privileges to DoS the device by sending a specifically crafted… |
CVE-2023-1619 | Medium | 4.9 | 2023-06-26 | Multiple WAGO devices in multiple versions may allow an authenticated remote attacker with high privileges to DoS the device by sending a malformed packet. |
CVE-2023-1150 | High | 7.5 | 2023-06-26 | Uncontrolled resource consumption in Series WAGO 750-3x/-8x products may allow an unauthenticated remote attacker to DoS the MODBUS server with specially craft… |
CVE-2023-1698 | Critical | 9.8 | 2023-05-15 | In multiple products of WAGO a vulnerability allows an unauthenticated, remote attacker to create new users and change the device configuration which can resul… |
CVE-2022-45140 | Critical | 9.8 | 2023-02-27 | The configuration backend allows an unauthenticated user to write arbitrary data with root privileges to the storage, which could lead to unauthenticated remot… |
CVE-2022-45139 | Medium | 5.3 | 2023-02-27 | A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver. In combina… |
CVE-2022-45138 | Critical | 9.8 | 2023-02-27 | The configuration backend of the web-based management can be used by unauthenticated users, although only authenticated users should be able to use the API. Th… |
CVE-2022-45137 | Medium | 6.1 | 2023-02-27 | The configuration backend of the web-based management is vulnerable to reflected XSS (Cross-Site Scripting) attacks that targets the users browser. This leads… |
CVE-2022-3843 | Critical | 9.1 | 2023-02-16 | In WAGO Unmanaged Switch (852-111/000-001) in firmware version 01 an undocumented configuration interface without authorization allows an remote attacker to re… |
CVE-2022-3738 | Medium | 5.9 | 2023-01-19 | The vulnerability allows a remote unauthenticated attacker to download a backup file, if one exists. That backup file might contain sensitive information like… |
CVE-2020-12069 | High | 7.8 | 2022-12-26 | In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system stores the online communication passwords… |
CVE-2021-34569 | Critical | 9.8 | 2022-11-09 | In WAGO I/O-Check Service in multiple products an attacker can send a specially crafted packet containing OS commands to crash the diagnostic tool and write me… |
CVE-2021-34568 | High | 7.5 | 2022-11-09 | In WAGO I/O-Check Service in multiple products an unauthenticated remote attacker can send a specially crafted packet containing OS commands to provoke a denia… |
CVE-2021-34567 | High | 8.2 | 2022-11-09 | In WAGO I/O-Check Service in multiple products an unauthenticated remote attacker can send a specially crafted packet containing OS commands to provoke a denia… |
CVE-2021-34566 | Critical | 9.1 | 2022-11-09 | In WAGO I/O-Check Service in multiple products an unauthenticated remote attacker can send a specially crafted packet containing OS commands to crash the ioche… |
CVE-2022-3281 | High | 7.5 | 2022-10-17 | WAGO Series PFC100/PFC200, Series Touch Panel 600, Compact Controller CC100 and Edge Controller in multiple versions are prone to a loss of MAC-Address-Filteri… |
CVE-2022-22511 | Medium | 5.4 | 2022-03-09 | Various configuration pages of the device are vulnerable to reflected XSS (Cross-Site Scripting) attacks. An authorized attacker with user privileges may use t… |
CVE-2021-34596 | Medium | 6.5 | 2021-10-26 | A crafted request may cause a read access to an uninitialized pointer in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56, resul… |
CVE-2021-34595 | High | 8.1 | 2021-10-26 | A crafted request with invalid offsets may cause an out-of-bounds read or write access in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions… |
CVE-2021-34593 | High | 7.5 | 2021-10-26 | In CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56 unauthenticated crafted invalid requests may result in several denial-of-ser… |
CVE-2021-34586 | High | 7.5 | 2021-10-26 | In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests may cause a Null pointer dereference in the CODESYS web server and may result in a… |
CVE-2021-34585 | High | 7.5 | 2021-10-26 | In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests can trigger a parser error. Since the parser result is not checked under all condit… |
CVE-2021-34584 | Critical | 9.1 | 2021-10-26 | Crafted web server requests can be utilised to read partial stack or heap memory or may trigger a denial-of- service condition due to a crash in the CODESYS V2… |
CVE-2021-34583 | High | 7.5 | 2021-10-26 | Crafted web server requests may cause a heap-based buffer overflow and could therefore trigger a denial-of- service condition due to a crash in the CODESYS V2… |
CVE-2021-34581 | High | 7.5 | 2021-08-31 | Missing Release of Resource after Effective Lifetime vulnerability in OpenSSL implementation of WAGO 750-831/xxx-xxx, 750-880/xxx-xxx, 750-881, 750-889 in vers… |
CVE-2021-34578 | Critical | 9.8 | 2021-08-31 | This vulnerability allows an attacker who has access to the WBM to read and write settings-parameters of the device by sending specifically constructed request… |
CVE-2021-30195 | High | 7.5 | 2021-05-25 | CODESYS V2 runtime system before 2.4.7.55 has Improper Input Validation. |
CVE-2021-30194 | Critical | 9.1 | 2021-05-25 | CODESYS V2 Web-Server before 1.1.9.20 has an Out-of-bounds Read. |
CVE-2021-30193 | Critical | 9.8 | 2021-05-25 | CODESYS V2 Web-Server before 1.1.9.20 has an Out-of-bounds Write. |
CVE-2021-30192 | Critical | 9.8 | 2021-05-25 | CODESYS V2 Web-Server before 1.1.9.20 has an Improperly Implemented Security Check. |
CVE-2021-30191 | High | 7.5 | 2021-05-25 | CODESYS V2 Web-Server before 1.1.9.20 has a a Buffer Copy without Checking the Size of the Input. |
CVE-2021-30190 | Critical | 9.8 | 2021-05-25 | CODESYS V2 Web-Server before 1.1.9.20 has Improper Access Control. |
CVE-2021-30189 | Critical | 9.8 | 2021-05-25 | CODESYS V2 Web-Server before 1.1.9.20 has a Stack-based Buffer Overflow. |
CVE-2021-30188 | Critical | 9.8 | 2021-05-25 | CODESYS V2 runtime system SP before 2.4.7.55 has a Stack-based Buffer Overflow. |
CVE-2021-30186 | High | 7.5 | 2021-05-25 | CODESYS V2 runtime system SP before 2.4.7.55 has a Heap-based Buffer Overflow. |
CVE-2021-30187 | Medium | 5.3 | 2021-05-25 | CODESYS V2 runtime system SP before 2.4.7.55 has Improper Neutralization of Special Elements used in an OS Command. |
CVE-2021-21001 | Critical | 9.1 | 2021-05-24 | On WAGO PFC200 devices in different firmware versions with special crafted packets an authorised attacker with network access to the device can access the file… |
CVE-2021-21000 | Medium | 5.3 | 2021-05-24 | On WAGO PFC200 devices in different firmware versions with special crafted packets an attacker with network access to the device could cause a denial of servic… |
CVE-2021-20998 | Critical | 10.0 | 2021-05-13 | In multiple managed switches by WAGO in different versions without authorization and with specially crafted packets it is possible to create users. |
CVE-2021-20997 | High | 7.5 | 2021-05-13 | In multiple managed switches by WAGO in different versions it is possible to read out the password hashes of all Web-based Management users. |
CVE-2021-20996 | Medium | 5.3 | 2021-05-13 | In multiple managed switches by WAGO in different versions special crafted requests can lead to cookies being transferred to third parties. |
CVE-2021-20995 | Medium | 5.3 | 2021-05-13 | In multiple managed switches by WAGO in different versions the webserver cookies of the web based UI contain user credentials. |
CVE-2021-20994 | High | 8.8 | 2021-05-13 | In multiple managed switches by WAGO in different versions an attacker may trick a legitimate user to click a link to inject possible malicious code into the W… |
CVE-2021-20993 | Medium | 5.3 | 2021-05-13 | In multiple managed switches by WAGO in different versions the activated directory listing provides an attacker with the index of the resources located inside… |
CVE-2020-12525 | High | 7.3 | 2021-01-22 | M&M Software fdtCONTAINER Component in versions below 3.5.20304.x and between 3.6 and 3.6.20304.x is vulnerable to deserialization of untrusted data in its pro… |
CVE-2020-12522 | Critical | 10.0 | 2020-12-17 | The reported vulnerability allows an attacker who has network access to the device to execute code with specially crafted packets in WAGO Series PFC 100 (750-8… |
CVE-2020-12516 | High | 7.5 | 2020-12-10 | Older firmware versions (FW1 up to FW10) of the WAGO PLC family 750-88x and 750-352 are vulnerable for a special denial of service attack. |
CVE-2020-12506 | Critical | 9.1 | 2020-09-30 | Improper Authentication vulnerability in WAGO 750-8XX series with FW version <= FW03 allows an attacker to change the settings of the devices by sending specif… |
CVE-2020-12505 | High | 8.2 | 2020-09-30 | Improper Authentication vulnerability in WAGO 750-8XX series with FW version <= FW07 allows an attacker to change some special parameters without authenticatio… |
CVE-2020-6090 | High | 7.2 | 2020-06-11 | An exploitable code execution vulnerability exists in the Web-Based Management (WBM) functionality of WAGO PFC 200 03.03.10(15). A specially crafted series of… |
CVE-2019-5186 | High | 7.0 | 2020-03-23 | An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service "I/O-Check" functionality of WAGO PFC 200. An attacker can send… |
CVE-2019-5185 | High | 7.0 | 2020-03-23 | An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service "I/O-Check" functionality of WAGO PFC 200. An attacker can send… |
CVE-2019-5184 | High | 7.8 | 2020-03-23 | An exploitable double free vulnerability exists in the iocheckd service "I/O-Check" functionality of WAGO PFC 200. A specially crafted XML cache file written t… |
CVE-2019-5181 | High | 7.8 | 2020-03-12 | An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service ‘I/O-Check’ functionality of WAGO PFC 200 Firmware version 03.0… |
CVE-2019-5180 | High | 7.8 | 2020-03-12 | An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service ‘I/O-Check’ functionality of WAGO PFC 200 Firmware version 03.0… |
CVE-2019-5179 | High | 7.8 | 2020-03-12 | An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service ‘I/O-Check’ functionality of WAGO PFC 200 Firmware version 03.0… |
CVE-2019-5178 | High | 7.8 | 2020-03-12 | An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service ‘I/O-Check’ functionality of WAGO PFC 200 Firmware version 03.0… |
CVE-2019-5177 | Medium | 5.5 | 2020-03-12 | An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service ‘I/O-Check’ functionality of WAGO PFC 200 Firmware version 03.0… |
CVE-2019-5176 | Medium | 5.5 | 2020-03-12 | An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service ‘I/O-Check’ functionality of WAGO PFC 200 Firmware version 03.0… |
CVE-2019-5171 | High | 7.8 | 2020-03-12 | An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 Firmware version 03.02.02(14). An attack… |
CVE-2019-5170 | High | 7.8 | 2020-03-12 | An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 Firmware version 03.02.02(14). A special… |
CVE-2019-5169 | High | 7.8 | 2020-03-12 | An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 Firmware version 03.02.02(14). A special… |
CVE-2019-5182 | Medium | 5.5 | 2020-03-11 | An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service ‘I/O-Check’ functionality of WAGO PFC 200 Firmware version 03.0… |