# cve.now: Wago

The newest entries naming Wago as an affected vendor (up to 200), of 99 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2025-41753](https://cve.now/CVE-2025-41753.md): Path traversal in dynamically created BACnet File Objects (CVSS 9.3)
- [CVE-2026-4769](https://cve.now/CVE-2026-4769.md): Unauthenticated Access to Internal Diagnostic Interface (CVSS 9.3)
- [CVE-2023-5872](https://cve.now/CVE-2023-5872.md): Wago: Vulnerability in Smart Designer Web-Application (CVSS 4.3)
- [CVE-2024-1490](https://cve.now/CVE-2024-1490.md): Wago: Vulnerability in WBM through Open VPN (CVSS 7.2)
- [CVE-2026-2328](https://cve.now/CVE-2026-2328.md): Backend Access Due to Insufficient Input Validation (CVSS 7.5)
- [CVE-2026-3587](https://cve.now/CVE-2026-3587.md): Hidden CLI Function Allows Root Access (CVSS 10.0)
- [CVE-2026-22906](https://cve.now/CVE-2026-22906.md): Hardcoded Key Allows Credential Disclosure (CVSS 9.8)
- [CVE-2026-22905](https://cve.now/CVE-2026-22905.md): Authentication Bypass via URI Traversal (CVSS 7.5)
- [CVE-2026-22904](https://cve.now/CVE-2026-22904.md): Stack Overflow via Oversized Cookie Fields in lighttpd (CVSS 9.8)
- [CVE-2026-22903](https://cve.now/CVE-2026-22903.md): Stack Overflow via SESSIONID Cookie in lighttpd (CVSS 9.8)
- [CVE-2022-50926](https://cve.now/CVE-2022-50926.md): WAGO 750-8212 PFC200 G2 2ETH RS Privilege Escalation (CVSS 8.7)
- [CVE-2025-41732](https://cve.now/CVE-2025-41732.md): Stack-based buffer overflow via unsafe sscanf in check\_cookie() (CVSS 9.8)
- [CVE-2025-41730](https://cve.now/CVE-2025-41730.md): Stack-based buffer overflow via unsafe sscanf in check\_account() (CVSS 9.8)
- [CVE-2025-41716](https://cve.now/CVE-2025-41716.md): Unauthenticated User Enumeration via Missing Authentication (CVSS 5.3)
- [CVE-2025-41715](https://cve.now/CVE-2025-41715.md): Missing Authentication for Database Access in Web Application (CVSS 9.8)
- [CVE-2025-41713](https://cve.now/CVE-2025-41713.md): WAGO: Vulnerability in hardware switch circuit (CVSS 6.5)
- [CVE-2025-41664](https://cve.now/CVE-2025-41664.md): Improper Permission Handling Enables Unauthorized Access to Firmware and Certificates (CVSS 7.5)
- [CVE-2025-41672](https://cve.now/CVE-2025-41672.md): WAGO: Vulnerability in WAGO Device Sphere (CVSS 10.0)
- [CVE-2025-25265](https://cve.now/CVE-2025-25265.md): Unauthenticated File Read via Web Interface (CVSS 4.9)
- [CVE-2025-25264](https://cve.now/CVE-2025-25264.md): Overly Permissive CORS Policy in WAGO Device Manager (CVSS 6.5)
- [CVE-2025-1235](https://cve.now/CVE-2025-1235.md): WAGO: Switches affected by year 2k38 problem (CVSS 4.3)
- [CVE-2025-0101](https://cve.now/CVE-2025-0101.md): WAGO: Year 2038 problem (CVSS 6.5)
- [CVE-2024-12650](https://cve.now/CVE-2024-12650.md): Wago: Vulnerability in libwagosnmp (CVSS 5.4)
- [CVE-2018-25108](https://cve.now/CVE-2018-25108.md): WAGO: Denial of service in 750-8xx controller due to uncontrolled resource consumption (CVSS 7.5)
- [CVE-2024-41974](https://cve.now/CVE-2024-41974.md): WAGO: BACNet Service Property Modification Due to Permission Misconfiguration in Multiple Devices (CVSS 7.1)
- [CVE-2024-41973](https://cve.now/CVE-2024-41973.md): WAGO: Remote Arbitrary File Write with Root Privileges in multiple Devices (CVSS 8.1)
- [CVE-2024-41972](https://cve.now/CVE-2024-41972.md): WAGO: Arbitrary File Overwrite Leading to Privileged File Read in Multiple Devices (CVSS 6.5)
- [CVE-2024-41971](https://cve.now/CVE-2024-41971.md): WAGO: Arbitrary File Overwrite in Multiple Devices (CVSS 8.1)
- [CVE-2024-41970](https://cve.now/CVE-2024-41970.md): WAGO: Unauthorized Diagnostic Data Exposure in Multiple Devices (CVSS 5.7)
- [CVE-2024-41969](https://cve.now/CVE-2024-41969.md): WAGO: CODESYS V3 Configuration Authentication Bypass in Multiple Devices (CVSS 8.8)
- [CVE-2024-41967](https://cve.now/CVE-2024-41967.md): WAGO: Boot Mode Manipulation in Multiple Devices (CVSS 8.1)
- [CVE-2024-41968](https://cve.now/CVE-2024-41968.md): WAGO: Docker Settings Manipulation in Multiple Devices (CVSS 5.4)
- [CVE-2018-25090](https://cve.now/CVE-2018-25090.md): Wago: Improper Neutralization of Input During Web Page Generation in multiple devices (CVSS 5.4)
- [CVE-2015-10123](https://cve.now/CVE-2015-10123.md): Wago: Buffer Copy without Checking Size of Input in wbm of multiple products (CVSS 8.8)
- [CVE-2023-5188](https://cve.now/CVE-2023-5188.md): WAGO Improper Input Validation in IEC61850 Server / Telecontrol (CVSS 7.5)
- [CVE-2023-4149](https://cve.now/CVE-2023-4149.md): WAGO: OS Command Injection Vulnerability in Managed Switch (CVSS 9.8)
- [CVE-2023-3379](https://cve.now/CVE-2023-3379.md): WAGO: Improper Privilege Management in web-based management (CVSS 5.3)
- [CVE-2023-4089](https://cve.now/CVE-2023-4089.md): WAGO: Multiple products vulnerable to local file inclusion (CVSS 2.7)
- [CVE-2023-1150](https://cve.now/CVE-2023-1150.md): WAGO: Series 750-3x/-8x prone to MODBUS server DoS (CVSS 7.5)
- [CVE-2023-1620](https://cve.now/CVE-2023-1620.md): WAGO: DoS in multiple products in multiple versions using Codesys (CVSS 4.9)
- [CVE-2023-1619](https://cve.now/CVE-2023-1619.md): WAGO: DoS in multiple versions of multiple products (CVSS 4.9)
- [CVE-2023-1698](https://cve.now/CVE-2023-1698.md): WAGO: WBM Command Injection in multiple products (CVSS 9.8)
- [CVE-2022-45140](https://cve.now/CVE-2022-45140.md): WAGO: Missing Authentication for Critical Function (CVSS 9.8)
- [CVE-2022-45139](https://cve.now/CVE-2022-45139.md): WAGO: Origin validation error through CORS misconfiguration (CVSS 5.3)
- [CVE-2022-45138](https://cve.now/CVE-2022-45138.md): WAGO: Missing Authentication for Critical Function (CVSS 9.8)
- [CVE-2022-45137](https://cve.now/CVE-2022-45137.md): WAGO: Reflective Cross-Site Scripting (CVSS 6.1)
- [CVE-2022-3843](https://cve.now/CVE-2022-3843.md): WAGO: Exposure of configuration interface in unmanaged switches (CVSS 9.1)
- [CVE-2022-3738](https://cve.now/CVE-2022-3738.md): WAGO: Missing authentication for config export functionality in multiple products (CVSS 5.9)
- [CVE-2021-34569](https://cve.now/CVE-2021-34569.md): WAGO I/O-Check Service prone to Out-of-bounds Write (CVSS 9.8)
- [CVE-2021-34568](https://cve.now/CVE-2021-34568.md): WAGO I/O-Check Service prone to Allocation of Resources Without Limits or Throttling (CVSS 7.5)
- [CVE-2021-34567](https://cve.now/CVE-2021-34567.md): WAGO I/O-Check Service prone to Out-of-bounds Read (CVSS 8.2)
- [CVE-2021-34566](https://cve.now/CVE-2021-34566.md): WAGO I/O-Check Service prone to Memory Overflow (CVSS 9.1)
- [CVE-2022-3281](https://cve.now/CVE-2022-3281.md): WAGO: multiple products - Loss of MAC-Address-Filtering after reboot (CVSS 7.5)
- [CVE-2022-22511](https://cve.now/CVE-2022-22511.md): WAGO PLCs WBM vulnerable to reflected XSS (CVSS 5.4)
- [CVE-2021-34581](https://cve.now/CVE-2021-34581.md): WAGO: Denial of Service vulnerability inside the OpenSSL implementation (CVSS 7.5)
- [CVE-2021-34578](https://cve.now/CVE-2021-34578.md): WAGO: Authentication Vulnerability in Web-Based Management (CVSS 9.8)
- [CVE-2021-21001](https://cve.now/CVE-2021-21001.md): WAGO: PFC200 Access to files outside the home directory (CVSS 9.1)
- [CVE-2021-21000](https://cve.now/CVE-2021-21000.md): WAGO: PFC200 Denial of Service due to the number of connections to the runtime (CVSS 5.3)
- [CVE-2021-20998](https://cve.now/CVE-2021-20998.md): WAGO: Managed Switches: Unauthorized creation of user accounts (CVSS 10.0)
- [CVE-2021-20997](https://cve.now/CVE-2021-20997.md): WAGO: Managed Switches: Unauthorized access to password hashes (CVSS 7.5)
- [CVE-2021-20996](https://cve.now/CVE-2021-20996.md): WAGO: Managed Switches: Unsecure Cookie settings (CVSS 5.3)
- [CVE-2021-20995](https://cve.now/CVE-2021-20995.md): WAGO: Managed Switches: Storage of user credentials in a cookie (CVSS 5.3)
- [CVE-2021-20994](https://cve.now/CVE-2021-20994.md): WAGO: Managed Switches: Reflected Cross-site Scripting (CVSS 8.8)
- [CVE-2021-20993](https://cve.now/CVE-2021-20993.md): WAGO: Managed Switches: Exposure of sensitive information through directory listing (CVSS 5.3)
- [CVE-2020-12522](https://cve.now/CVE-2020-12522.md): Command Injection Vulnerability in I/O-Check Service of WAGO PFC100, PFC200 and Touch Panel 600 Series with firmware versions \<=FW10 (CVSS 10.0)
- [CVE-2020-12516](https://cve.now/CVE-2020-12516.md): WAGO: PLC families 750-88x and 750-352 prone to DoS attack (CVSS 7.5)
- [CVE-2020-12506](https://cve.now/CVE-2020-12506.md): WAGO: Authentication Bypass Vulnerability in WAGO 750-36X and WAGO 750-8XX Versions \<= FW03 (CVSS 9.1)
- [CVE-2020-12505](https://cve.now/CVE-2020-12505.md): WAGO: Vulnerability in web-based authentication in WAGO 750-8XX Version \<= FW07 (CVSS 8.2)
- [CVE-2019-5181](https://cve.now/CVE-2019-5181.md): An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service ‘I/O-Check’ functionality of WAGO PFC 200 Fi (no CVSS)
- [CVE-2019-5180](https://cve.now/CVE-2019-5180.md): An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service ‘I/O-Check’ functionality of WAGO PFC 200 Fi (no CVSS)
- [CVE-2019-5179](https://cve.now/CVE-2019-5179.md): An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service ‘I/O-Check’ functionality of WAGO PFC 200 Fi (no CVSS)
- [CVE-2019-5178](https://cve.now/CVE-2019-5178.md): An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service ‘I/O-Check’ functionality of WAGO PFC 200 Fi (no CVSS)
- [CVE-2019-5177](https://cve.now/CVE-2019-5177.md): An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service ‘I/O-Check’ functionality of WAGO PFC 200 Fi (no CVSS)
- [CVE-2019-5176](https://cve.now/CVE-2019-5176.md): An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service ‘I/O-Check’ functionality of WAGO PFC 200 Fi (no CVSS)
- [CVE-2019-5171](https://cve.now/CVE-2019-5171.md): An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 Firmware version 03.0 (no CVSS)
- [CVE-2019-5170](https://cve.now/CVE-2019-5170.md): An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 Firmware version 03.0 (no CVSS)
- [CVE-2019-5169](https://cve.now/CVE-2019-5169.md): An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 Firmware version 03.0 (no CVSS)
- [CVE-2019-5174](https://cve.now/CVE-2019-5174.md): An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 version 03.02.02(14). (no CVSS)
- [CVE-2019-5175](https://cve.now/CVE-2019-5175.md): An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 Firmware version 03.0 (no CVSS)
- [CVE-2019-5172](https://cve.now/CVE-2019-5172.md): An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 Firmware version 03.0 (no CVSS)
- [CVE-2019-5173](https://cve.now/CVE-2019-5173.md): An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 Firmware version 03.0 (no CVSS)
- [CVE-2019-5182](https://cve.now/CVE-2019-5182.md): An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service ‘I/O-Check’ functionality of WAGO PFC 200 Fi (no CVSS)
- [CVE-2019-5106](https://cve.now/CVE-2019-5106.md): A hard-coded encryption key vulnerability exists in the authentication functionality of WAGO e!Cockpit version 1.5.1.1. (no CVSS)
- [CVE-2019-5107](https://cve.now/CVE-2019-5107.md): A cleartext transmission vulnerability exists in the network communication functionality of WAGO e!Cockpit version 1.5.1.1. (no CVSS)
- [CVE-2019-5134](https://cve.now/CVE-2019-5134.md): An exploitable regular expression without anchors vulnerability exists in the Web-Based Management (WBM) authentication functionality of WAG (no CVSS)
- [CVE-2019-5161](https://cve.now/CVE-2019-5161.md): An exploitable remote code execution vulnerability exists in the Cloud Connectivity functionality of WAGO PFC200 versions 03.02.02(14), 03.0 (no CVSS)
- [CVE-2019-5156](https://cve.now/CVE-2019-5156.md): An exploitable command injection vulnerability exists in the cloud connectivity functionality of WAGO PFC200 versions 03.02.02(14), 03.01.07 (no CVSS)
- [CVE-2019-5157](https://cve.now/CVE-2019-5157.md): An exploitable command injection vulnerability exists in the Cloud Connectivity functionality of WAGO PFC200 Firmware versions 03.02.02(14), (no CVSS)
- [CVE-2019-5158](https://cve.now/CVE-2019-5158.md): An exploitable firmware downgrade vulnerability exists in the firmware update package functionality of the WAGO e!COCKPIT automation softwar (no CVSS)
- [CVE-2019-5159](https://cve.now/CVE-2019-5159.md): An exploitable improper input validation vulnerability exists in the firmware update functionality of WAGO e!COCKPIT automation software v1. (no CVSS)
- [CVE-2019-5160](https://cve.now/CVE-2019-5160.md): An exploitable improper host validation vulnerability exists in the Cloud Connectivity functionality of WAGO PFC200 Firmware versions 03.02. (no CVSS)
- [CVE-2019-5168](https://cve.now/CVE-2019-5168.md): An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 version 03.02.02(14). (no CVSS)
- [CVE-2019-5167](https://cve.now/CVE-2019-5167.md): An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 version 03.02.02(14). (no CVSS)
- [CVE-2019-5166](https://cve.now/CVE-2019-5166.md): An exploitable stack buffer overflow vulnerability exists in the iocheckd service ‘I/O-Check’ functionality of WAGO PFC 200 version 03.02.02 (no CVSS)
- [CVE-2019-5135](https://cve.now/CVE-2019-5135.md): An exploitable timing discrepancy vulnerability exists in the authentication functionality of the Web-Based Management (WBM) web application (no CVSS)
- [CVE-2019-5149](https://cve.now/CVE-2019-5149.md): The WBM web application on firmwares prior to 03.02.02 and 03.01.07 on the WAGO PFC100 and PFC2000, respectively, runs on a lighttpd web ser (no CVSS)
- [CVE-2019-5155](https://cve.now/CVE-2019-5155.md): An exploitable command injection vulnerability exists in the cloud connectivity feature of WAGO PFC200. (no CVSS)
- [CVE-2019-10953](https://cve.now/CVE-2019-10953.md): ABB, Phoenix Contact, Schneider Electric, Siemens, WAGO - Programmable Logic Controllers, multiple versions. (CVSS 7.5)
- [CVE-2018-8836](https://cve.now/CVE-2018-8836.md): Wago 750 Series PLCs with firmware version 10 and prior include a remote attack may take advantage of an improper implementation of the 3 wa (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/wago
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.