WAGO I/O-Field CVE-2026-4769

Exploitation requires network access to the affected WAGO System I/O-Field 0765-series device AND that the device be in its initial startup/early boot sequence, during which the undocumented internal diagnostic capability is temporarily activated and reachable without authentication. The concrete prerequisite is timing: the attacker must connect within the brief early-boot window when the diagnostic interface is exposed, meaning exploitation is naturally limited to reboot events (attacker either races an existing reboot or must be able to induce one). No authentication, no privileges (PR:N), and no user interaction are needed within that window, but the fleeting boot-time exposure is the key limiting factor that reduces realistic exploitability compared to a persistently exposed service.

The signals mostly align on high severity but with one important nuance. The CERT@VDE-assigned CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H = 9.3) describes a network-reachable, unauthenticated path to full compromise, which is genuinely serious for OT equipment. However, the description qualifies exploitation as possible only 'for a brief period in the early boot phase,' which is a real timing constraint the assigned vector does not fully capture (it uses AC:L/AT:N). In practice an attacker must catch the device during boot or force a reboot, so I independently assess the attack complexity as higher than the vendor vector implies. No EPSS score was provided, there is no KEV listing, and no POC is referenced, so there is currently no evidence of active or automated exploitation - this reads as a high-impact but condition-dependent issue rather than a mass-exploited one. Priority should still be high for exposed/OT-networked units given the unauthenticated full-compromise outcome, but the boot-window requirement meaningfully limits opportunistic attacks.

An attacker with network reachability to a WAGO 0765 controller waits for or induces a device reboot, then connects to the undocumented diagnostic interface during the brief early-boot window and interacts with internal system processes to seize full control of the controller. No credentials or user interaction are required. No public POC has been identified, so this scenario is inferred from the CVSS network/unauthenticated vector and the CWE-912 hidden-functionality description.