WAGO Controllers EUVD-2025-211020

Requires network reachability to the device's BACnet service (BACnet/IP), with the ability to dynamically create a BACnet File Object - a standard BACnet operation, so no special non-default feature toggle is implied. Exploitation is unauthenticated (PR:N) and needs no user interaction (UI:N). The limiting factor is network exposure: these WAGO controllers are typically deployed on building-automation/industrial networks, so an attacker must be able to reach the BACnet endpoint (directly, via a flat network, or through a compromised adjacent host). Affected products are the WAGO 0751-9x01, 0750-811x/0750-821x, 0762-420x/430x/520x/530x/620x/630x-8000 series, and 0752-8303-8000-0002 controllers.

This is a genuine high-priority issue, not a CVSS-inflation artifact. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, 9.3) describes the worst realistic combination for an OT device: network-reachable, low complexity, no authentication, no user interaction, with full confidentiality, integrity and availability impact. Because the BACnet File Object's name is treated as a file path with insufficient validation, an unauthenticated attacker can both read and overwrite arbitrary files, and the description explicitly states this 'may lead to full system compromise' - consistent with the VC:H/VI:H/VA:H scoring. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the risk is driven by the pre-conditions (unauthenticated + network) rather than observed in-the-wild activity. The main tempering factor is deployment reality: these are WAGO industrial controllers typically on segmented/isolated OT networks, so real-world exposure depends heavily on whether BACnet (and the device) is reachable by the attacker. All signals (CVSS 4.0 and the description) are internally consistent - no conflicting attack-vector/privilege data to flag.

An attacker with network reachability to a WAGO controller's BACnet/IP service dynamically creates a BACnet File Object whose object name contains a relative path (e.g. '../../etc/passwd' or a path to a boot/config file). Because the name is used as a file path without directory containment, the attacker reads sensitive files or overwrites system/configuration files, pivoting to full control of the controller. No authentication or user interaction is required; no public POC is referenced in the input.