Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

WAGO — Vulnerabilities & Security Advisories 97

Browse all 97 CVE security advisories affecting WAGO. AI-powered Chinese analysis, POCs, and references for each vulnerability.

WAGO specializes in automation technology, primarily manufacturing programmable logic controllers and I/O systems for industrial environments. With 96 recorded Common Vulnerabilities and Exposures, the company’s products have historically been susceptible to remote code execution, cross-site scripting, and privilege escalation flaws. These vulnerabilities often stem from weak authentication mechanisms, insecure default configurations, and insufficient input validation within web-based management interfaces. Notable incidents include critical flaws allowing unauthenticated attackers to execute arbitrary commands or bypass access controls, potentially disrupting industrial operations. The high volume of CVEs reflects the complexity of embedded systems and the evolving threat landscape targeting operational technology. While WAGO releases security updates, the persistent nature of these issues highlights ongoing challenges in securing legacy industrial infrastructure against sophisticated cyber threats.

CVE ID Title CVSS Severity Published
CVE-2024-41968 WAGO: Docker Settings Manipulation in Multiple Devices — CC100 0751-9x01 CWE-306 5.4 Medium 2024-11-18
CVE-2018-25090 Wago: Improper Neutralization of Input During Web Page Generation in multiple devices — Controller BACnet/IP CWE-79 5.4 Medium 2024-03-13
CVE-2015-10123 Wago: Buffer Copy without Checking Size of Input in wbm of multiple products — Controller BACnet/IP CWE-120 8.8 High 2024-03-13
CVE-2023-5188 WAGO Improper Input Validation in IEC61850 Server / Telecontrol — Telecontrol Configurator CWE-20 7.5 High 2023-12-05
CVE-2023-4149 WAGO: OS Command Injection Vulnerability in Managed Switch — Industrial Managed Switch (0852-0602) CWE-78 9.8 Critical 2023-11-21
CVE-2023-3379 WAGO: Improper Privilege Management in web-based management — Compact Controller 100 (751-9301) CWE-863 5.3 Medium 2023-11-20
CVE-2023-4089 WAGO: Multiple products vulnerable to local file inclusion — Compact Controller CC100 CWE-610 2.7 Low 2023-10-17
CVE-2023-1150 WAGO: Series 750-3x/-8x prone to MODBUS server DoS — 750-332 CWE-772 7.5 High 2023-06-26
CVE-2023-1620 WAGO: DoS in multiple products in multiple versions using Codesys — 750-8202/xxx-xxx CWE-1288 4.9 Medium 2023-06-26
CVE-2023-1619 WAGO: DoS in multiple versions of multiple products — 750-8202/xxx-xxx CWE-1288 4.9 Medium 2023-06-26
CVE-2023-1698 WAGO: WBM Command Injection in multiple products — Compact Controller CC100 CWE-78 9.8 Critical 2023-05-15
CVE-2022-45140 WAGO: Missing Authentication for Critical Function — Compact Controller CC100 (751-9301) CWE-306 9.8 Critical 2023-02-27
CVE-2022-45139 WAGO: Origin validation error through CORS misconfiguration — Compact Controller CC100 (751-9301) CWE-346 5.3 Medium 2023-02-27
CVE-2022-45138 WAGO: Missing Authentication for Critical Function — Compact Controller CC100 (751-9301) CWE-306 9.8 Critical 2023-02-27
CVE-2022-45137 WAGO: Reflective Cross-Site Scripting — Compact Controller CC100 (751-9301) CWE-79 6.1 Medium 2023-02-27
CVE-2022-3843 WAGO: Exposure of configuration interface in unmanaged switches — Unmanaged Switch 852-111/000-001 CWE-912 9.1 Critical 2023-02-16
CVE-2022-3738 WAGO: Missing authentication for config export functionality in multiple products — Series WAGO PFC100 CWE-306 5.9 Medium 2023-01-19
CVE-2021-34569 WAGO I/O-Check Service prone to Out-of-bounds Write — 750-81xx/xxx-xxxFW CWE-787 9.8 Critical 2022-11-09
CVE-2021-34568 WAGO I/O-Check Service prone to Allocation of Resources Without Limits or Throttling — 750-81xx/xxx-xxxFW CWE-770 7.5 High 2022-11-09
CVE-2021-34567 WAGO I/O-Check Service prone to Out-of-bounds Read — 750-81xx/xxx-xxxFW CWE-125 8.2 High 2022-11-09
CVE-2021-34566 WAGO I/O-Check Service prone to Memory Overflow — 750-81xx/xxx-xxxFW CWE-120 9.1 Critical 2022-11-09
CVE-2022-3281 WAGO: multiple products - Loss of MAC-Address-Filtering after reboot — 750-81xx/xxx-xxx Series PFC100/PFC200 CWE-440 7.5 High 2022-10-17
CVE-2022-22511 WAGO PLCs WBM vulnerable to reflected XSS — Compact Controller CC100 (751-9301) CWE-79 5.4 Medium 2022-03-09
CVE-2021-34581 WAGO: Denial of Service vulnerability inside the OpenSSL implementation — 750-831/xxx-xxx, 750-880/xxx-xxx, 750-881, 750-889 CWE-772 7.5 High 2021-08-31
CVE-2021-34578 WAGO: Authentication Vulnerability in Web-Based Management — PLC CWE-287 9.8 Critical 2021-08-31
CVE-2021-21001 WAGO: PFC200 Access to files outside the home directory — Series PFC200 Controller CWE-22 9.1 Critical 2021-05-24
CVE-2021-21000 WAGO: PFC200 Denial of Service due to the number of connections to the runtime — Series PFC200 Controller CWE-770 5.3 Medium 2021-05-24
CVE-2021-20998 WAGO: Managed Switches: Unauthorized creation of user accounts — 0852-0303 CWE-306 10.0 Critical 2021-05-13
CVE-2021-20997 WAGO: Managed Switches: Unauthorized access to password hashes — 0852-0303 CWE-522 7.5 High 2021-05-13
CVE-2021-20996 WAGO: Managed Switches: Unsecure Cookie settings — 0852-0303 CWE-732 5.3 Medium 2021-05-13

This page lists every published CVE security advisory associated with WAGO. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.