0750 811X Xxxx Xxxx
Monthly
Unauthenticated remote attackers can read or overwrite arbitrary files on affected WAGO controllers by creating a BACnet File Object whose object name is used as a file path without adequate validation, allowing directory traversal out of the intended storage location and potentially leading to full device compromise. The affected lines are the WAGO 0751-9x01, 0750-811x/0750-821x, 0762-420x/430x/520x/530x/620x/630x-8000 and 0752-8303-8000-0002 controllers; exploitation requires network reachability to the device's BACnet/IP service, but no authentication (PR:N) and no user interaction (UI:N) are needed, and dynamically creating a BACnet File Object is a standard protocol operation rather than a hidden feature. There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); the practical limiting factor is exposure, since these controllers normally sit on building-automation or industrial networks, so an attacker would need direct access, a flat network, or a compromised adjacent host to reach the BACnet endpoint. This is a genuine high-priority issue, not a CVSS-inflation artifact, as reflected in the CERTVDE advisory VDE-2025-102.
Unauthenticated remote attackers can read or overwrite arbitrary files on affected WAGO controllers by creating a BACnet File Object whose object name is used as a file path without adequate validation, allowing directory traversal out of the intended storage location and potentially leading to full device compromise. The affected lines are the WAGO 0751-9x01, 0750-811x/0750-821x, 0762-420x/430x/520x/530x/620x/630x-8000 and 0752-8303-8000-0002 controllers; exploitation requires network reachability to the device's BACnet/IP service, but no authentication (PR:N) and no user interaction (UI:N) are needed, and dynamically creating a BACnet File Object is a standard protocol operation rather than a hidden feature. There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); the practical limiting factor is exposure, since these controllers normally sit on building-automation or industrial networks, so an attacker would need direct access, a flat network, or a compromised adjacent host to reach the BACnet endpoint. This is a genuine high-priority issue, not a CVSS-inflation artifact, as reflected in the CERTVDE advisory VDE-2025-102.