Vulnerabilidades de WAGO
CVEs publicadas que afetam produtos de WAGO: 12 registro(s), com severidade, exploração e correções.
0852-1328 40852-1322 40852-1322 Firmware 20852-1328 Firmware 2Indsutrial-Managed-Switches 2PFC200 G2 (750-821x-xxxx-xxxx) 10762-340x 1TP600 (0762-420x-8000-000x) 1TP600 (0762-430x-8000-000x) 1TP600 (0762-520x-8000-000x) 1TP600 (0762-530x-8000-000x) 1TP600 (0762-620x-8000-000x) 1TP600 (0762-630x-8000-000x) 1Edge Controller (0752-8303-8000-0002) 1WP400 (0762-340x) 1Smart Designer 10751-9x01 10750-811x-xxxx-xxxx 10750-821x-xxx-xxx 10762-420x-8000-000x 10762-430x-8000-000x 10762-520x-8000-000x 10762-530x-8000-000x 10762-620x-8000-000x 10762-630x-8000-000x 10752-8303-8000-0002 1Industrial Managed Switch 852-1505 1Device Sphere 1Solution Builder 1WAGO 750-8212 PFC200 1Lean Managed Switch 852-1812 1Lean Managed Switch 852-1813 1Lean Managed Switch 852-1813-000-001 1Lean Managed Switch 852-1816 1Industrial Managed Switch 852-303 1Industrial Managed Switch 852-1305 1Industrial Managed Switch 852-1305-000-001 1Industrial Managed Switch 852-1505-000-001 1PFC200 G1 (750-820x-xxxx-xxxx) 1Industrial Managed Switch 852-602 1
CVE-2025-41753
Crítica · 9.8
CWE-22 01/10/2026
Path traversal in dynamically created BACnet File Objects
The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation. Because relative paths are not limited to the intended directory, an unauthenticated remote attacker can traverse outside of it and read or overwrite arbitrary files on the device, which may lead to full system compromise.
CVE-2023-5872
Média · 4.3
CWE-203 16/04/2026
Wago: Vulnerability in Smart Designer Web-Application
In Wago Smart Designer in versions up to 2.33.1 a low privileged remote attacker may enumerate projects and usernames through iterative requests to an specific endpoint.
CVE-2024-1490
Alta · 7.2
CWE-94 09/04/2026
Wago: Vulnerability in WBM through Open VPN
An authenticated remote attacker with high privileges can exploit the OpenVPN configuration via the web-based management interface of a WAGO PLC. If user-defined scripts are permitted, OpenVPN may allow the execution of arbitrary shell commands enabling the attacker to run arbitrary commands on the device.
CVE-2026-2328
Alta · 7.5
CWE-790 30/03/2026
Backend Access Due to Insufficient Input Validation
An unauthenticated remote attacker can exploit insufficient input validation to access backend components beyond their intended scope via path traversal, resulting in exposure of sensitive information.
CVE-2026-3587
Crítica · 10.0
CWE-912 23/03/2026
Hidden CLI Function Allows Root Access
An unauthenticated remote attacker can exploit a hidden function in the CLI prompt to escape the restricted interface, leading to full compromise of the device.
CVE-2026-22906
Crítica · 9.8
CWE-321 09/02/2026
Armazenamento de credenciais com AES-ECB e chave fixa no código, expondo usuários e senhas (CWE-321)
As credenciais de usuários são armazenadas usando criptografia AES-ECB com uma chave codificada diretamente no código (hardcoded). Um atacante remoto não autenticado que obtenha o arquivo de configuração pode descriptografar e recuperar nomes de usuário e senhas em texto claro, especialmente quando combinado com o bypass de autenticação.
CVE-2026-22905
Alta · 7.5
CWE-22 09/02/2026
Authentication Bypass via URI Traversal
An unauthenticated remote attacker can bypass authentication by exploiting insufficient URI validation and using path traversal sequences (e.g., /js/../cgi-bin/post.cgi), gaining unauthorized access to protected CGI endpoints and configuration downloads.
CVE-2026-22904
Crítica · 9.8
CWE-121 09/02/2026
Estouro de buffer na pilha no processamento de cookies (CWE-121)
Tratamento inadequado de comprimento ao analisar múltiplos campos de cookie (incluindo TRACKID) permite que um atacante remoto não autenticado envie valores de cookie superdimensionados e acione um estouro de buffer na pilha, resultando em uma condição de negação de serviço e possível execução remota de código.
CVE-2026-22903
Crítica · 9.8
CWE-121 09/02/2026
Estouro de buffer na pilha no lighttpd (modificado) via cookie SESSIONID
Um atacante remoto não autenticado pode enviar uma requisição HTTP elaborada contendo um cookie SESSIONID excessivamente longo. Isso pode acionar um estouro de buffer na pilha no servidor lighttpd modificado, fazendo-o travar e possivelmente permitindo execução remota de código devido à ausência de proteções de pilha.
CVE-2022-50926
Crítica · 9.8
CWE-565 13/01/2026
WAGO 750-8212 PFC200 G2 2ETH RS Privilege Escalation
WAGO 750-8212 PFC200 G2 2ETH RS firmware contains a privilege escalation vulnerability that allows attackers to manipulate user session cookies. Attackers can modify the cookie's 'name' and 'roles' parameters to elevate from ordinary user to administrative privileges without authentication.
CVE-2025-41732
Crítica · 9.8
CWE-787 10/12/2025
Stack-based buffer overflow via unsafe sscanf in check_cookie()
An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_cookie() function to write arbitrary data into fixed-size stack buffers which leads to full device compromise.
CVE-2025-41730
Crítica · 9.8
CWE-787 10/12/2025
Stack-based buffer overflow via unsafe sscanf in check_account()
An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_account() function to write arbitrary data into fixed-size stack buffers which leads to full device compromise.