CVE-2025-41672 WAGO: Vulnerability in WAGO Device Sphere

A remote unauthenticated attacker may use default certificates to generate JWT Tokens and gain full access to the tool and all connected devices...

PT-2025-28136

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: A remote unauthenticated attacker may use default certificates to generate JWT Tokens and gain full access to the tool and all connected devices. Recommendations: At the moment, there is no...

WAGO Device Sphere 安全漏洞

WAGO Device Sphere is a device management system from WAGO Germany. A security vulnerability exists in WAGO Device Sphere, which can be exploited by a remote, unauthenticated attacker to generate a JWT token using default certificates to gain full access...

The vulnerability of the WAGO Device Manager software in terms of controller configuration and parameter setting lies in the lack of authentication for critical functions. This allows attackers to gain unauthorized access to the file system.

The vulnerability of the WAGO Device Manager software for configuring and parameterizing controllers is related to the lack of authentication for critical functions. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to the file system by sending...

The vulnerability of the WAGO Device Manager software in terms of configuration and parameter setting allows a malicious individual to gain unauthorized access to the file system. This vulnerability is related to errors in configuring CORS policies.

The vulnerability of the WAGO Device Manager software for configuring and parameterizing controllers is related to errors in configuring CORS policies. Exploiting this vulnerability can allow a malicious actor to gain unauthorized access to the file system by sending specially crafted requests...

CVE-2025-25264 Overly Permissive CORS Policy in WAGO Device Manager

An unauthenticated remote attacker can trick an admin to visit a website containing malicious java script code. The current overly permissive CORS policy allows the attacker to obtain any files from the file system...

CVE-2025-25264

CVE-2025-25264 describes an unauthenticated remote attack against WAGO Device Manager, where an attacker can trick an admin to visit a page containing malicious JavaScript. The root cause is an overly permissive CORS policy that allows access to files on the affected system, enabling potential di...

CVE-2025-25264 Overly Permissive CORS Policy in WAGO Device Manager

An unauthenticated remote attacker can trick an admin to visit a website containing malicious java script code. The current overly permissive CORS policy allows the attacker to obtain any files from the file system...

WAGO Device Manager 访问控制错误漏洞

WAGO Device Manager is owned by WAGO Germany. An access control error vulnerability exists in WAGO Device Manager that originates from an unauthenticated, remote attacker being able to read system files...

WAGO Device Manager 安全漏洞

WAGO Device Manager is a device manager software from WAGO. A security vulnerability exists in WAGO Device Manager that stems from the current overly lax CORS policy and could lead to the disclosure of sensitive data...

Exploit for OS Command Injection in Wago Compact_Controller_100_Firmware

CVE-2023-1698 CVE-2023-1698 exploit with golang how t...

CVE-2025-1235

CVE-2025-1235 affects WAGO Fully Managed Switches. A low-privilege attacker can set the device date to Jan 19, 2038, triggering 32‑bit time overflow and the switch date rolling back to Jan 1, 1970. Public details in provided documents confirm the issue and lack of patch/version information; no re...

CVE-2025-1235 WAGO: Switches affected by year 2k38 problem

A low privileged attacker can set the date of the devices to the 19th of January 2038 an therefore exceed the 32-Bit time limit. This causes the date of the switch to be set back to January 1st, 1970...

CVE-2025-1235 WAGO: Switches affected by year 2k38 problem

A low privileged attacker can set the date of the devices to the 19th of January 2038 an therefore exceed the 32-Bit time limit. This causes the date of the switch to be set back to January 1st, 1970...

WAGO Fully Managed Switches 输入验证错误漏洞

WAGO Fully Managed Switches is a series of switches from WAGO Germany. An input validation error vulnerability exists in WAGO Fully Managed Switches that stems from mishandling of 32-bit time constraints, which can lead to date resets...

CVE-2023-3379

Wago web-based management of multiple products has a vulnerability which allows an local authenticated attacker to change the passwords of other non-admin users and thus to escalate non-root privileges...

CVE-2023-1620

Multiple WAGO devices in multiple versions may allow an authenticated remote attacker with high privileges to DoS the device by sending a specifically crafted packet to the CODESYS V2 runtime...

CVE-2023-1619

Multiple WAGO devices in multiple versions may allow an authenticated remote attacker with high privileges to DoS the device by sending a malformed packet...

CVE-2023-1150

Uncontrolled resource consumption in Series WAGO 750-3x/-8x products may allow an unauthenticated remote attacker to DoS the MODBUS server with specially crafted packets...

CVE-2023-1698

In multiple products of WAGO a vulnerability allows an unauthenticated, remote attacker to create new users and change the device configuration which can result in unintended behaviour, Denial of Service and full system compromise...