Which versions of WAGO I/O-Field are affected by CVE-2026-4769?

WAGO System I/O-Field series controllers (0765-xxx families) expose an unauthenticated diagnostic interface during boot that permits full system compromise; no public exploit has been identified at…. A patch is available.

How to fix or mitigate CVE-2026-4769?

Within 24 hours, inventory all WAGO System I/O-Field series controller (0765-xxx) installations and assess their network exposure, documenting connection points and data criticality. Within 7 days, implement network segmentation to restrict device access to authorized networks only, disable non-essential network services on affected controllers where operationally feasible, and enable enhanced logging for early-boot activity and diagnostic interface access attempts. Within 30 days, maintain active contact with WAGO for patch releases, perform periodic firmware audits to detect unauthorized modifications, and develop contingency plans including alternative control systems if patch availability timeline becomes untenable.

WAGO I/O-Field CVE-2026-4769

Q: What is the CVSS score of CVE-2026-4769?

CVE-2026-4769 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-43297 CRITICAL

Hidden Functionality (CWE-912)

2026-07-13 CERTVDE

GHSA-2r6r-vgg5-p59v

Information Disclosure 0765 110X 0100 0000 0765 120X 0100 0000 0765 150X 0100 0000 0765 2101 0100 0000 0765 2102 0100 0000 0765 410X 0100 0000 0765 420X 0100 0000 0765 450X 0100 0000

9.3

CVSS 4.0 · Vendor: CERTVDE

Severity by source

Vendor (CERTVDE) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Unauthenticated network access yields full impact (PR:N, C/I/A:H), but the interface is only reachable during a fleeting boot window, a timing condition outside attacker control, so AC:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (CERTVDE).

CVSS VectorVendor: CERTVDE

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 13, 2026 - 09:01 EUVD

Analysis Generated

Jul 13, 2026 - 08:21 vuln.today

CVE Published

Jul 13, 2026 - 06:35 cve.org

CRITICAL 9.3

DescriptionCVE.org

Certain devices in the WAGO System I/O Field series activate an internal diagnostic capability during the initial startup sequence. This functionality is not formally documented and becomes accessible without authentication for a brief period in the early boot phase. During this window, an unauthenticated remote attacker can gain access to the internal system processes, resulting in full system compromise.

AnalysisAI

Full system compromise of WAGO System I/O-Field series controllers (0765-xxx families) is possible when an unauthenticated remote attacker reaches an undocumented internal diagnostic interface that is briefly exposed during the device's early boot phase. Because the diagnostic capability requires no authentication and grants access to internal system processes, a successful attacker obtains complete control over confidentiality, integrity, and availability. Reported by CERT@VDE (VDE-2026-031); no public exploit code has been identified and it is not listed in CISA KEV at time of analysis.

Technical ContextAI

The affected devices are WAGO industrial fieldbus/I/O controllers in the 0765 (System I/O-Field) product line, confirmed by CPE strings covering the 0765-110x, 0765-120x, 0765-150x, 0765-2101, 0765-2102, 0765-410x, 0765-420x, and 0765-450x hardware variants (firmware/revision 0100-0000). The root cause maps to CWE-912 (Hidden Functionality): a diagnostic routine intended for internal use is silently activated during the initial startup sequence and is left reachable over the network without any access control during that startup window. Such 'hidden' diagnostic or debug channels are common in embedded/OT firmware, where boot-time service managers bring up maintenance interfaces before the authentication and hardening layers of the runtime are fully initialized, creating a race-condition exposure that documented interfaces do not reveal.

RemediationAI

No vendor-released patched firmware version is stated in the available data, so consult the CERT@VDE advisory VDE-2026-031 (https://www.certvde.com/en/advisories/VDE-2026-031/) for WAGO's official fixed-firmware guidance and apply it once published; do not act on invented version numbers. Because the exposure occurs during the early boot window, the most effective compensating control is to prevent untrusted network access to the devices around reboots: isolate the 0765 controllers on a dedicated, firewalled OT segment or VLAN and deny all inbound access from IT/corporate and internet-facing networks (trade-off: legitimate remote engineering access must be brokered through a jump host/VPN). Restrict and monitor who can power-cycle or remotely reboot the devices, since an attacker who can trigger reboots can repeatedly re-open the window; and avoid unnecessary restarts of exposed units until firmware is remediated. Where possible, place the devices behind an OT-aware firewall or data diode that blocks the diagnostic access path during startup.