Description (CNA)
An authenticated remote attacker with high privileges can exploit the OpenVPN configuration via the web-based management interface of a WAGO PLC. If user-defined scripts are permitted, OpenVPN may allow the execution of arbitrary shell commands enabling the attacker to run arbitrary commands on the device.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| WAGO / CC100 (0751-9x01) | affected 0.0.0 through 4.5.10 |
| WAGO / PFC100 G1 (0750-810-xxxx-xxxx) | affected 0.0.0 through 3.10.10 |
| WAGO / PFC100 G2 (0750-811x-xxxx-xxxx) | affected 0.0.0 through 4.5.10 |
| WAGO / PFC200 G1 (750-820x-xxxx-xxxx) | affected 0.0.0 through 3.10.10 |
| WAGO / PFC200 G2 (750-821x-xxxx-xxxx) | affected 0.0.0 through 4.5.10 |
| WAGO / TP600 (0762-420x-8000-000x) | affected 0.0.0 through FW 26 |
| WAGO / TP600 (0762-430x-8000-000x) | affected 0.0.0 through 4.5.10 |
| WAGO / TP600 (0762-520x-8000-000x) | affected 0.0.0 through 4.5.10 |
| WAGO / TP600 (0762-530x-8000-000x) | affected 0.0.0 through 4.5.10 |
| WAGO / TP600 (0762-620x-8000-000x) | affected 0.0.0 |
| WAGO / TP600 (0762-630x-8000-000x) | affected 0.0.0 through 4.5.10 |
| WAGO / Edge Controller (0752-8303-8000-0002) | affected 0.0.0 through 4.5.10 |
| WAGO / WP400 (0762-340x) | affected 0.0.0 through 4.5.10 |
CWE
CWE-94
References
- https://certvde.com/de/advisories/VDE-2024-008
- https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2024-008.json
ADP enrichment
No English description supplied.
No references supplied.