Vulnerability-Lookup

VDE-2025-018

Vulnerability from csaf_wagogmbhcokg - Published: 2025-06-16 10:00 - Updated: 2025-11-21 12:00

Summary

WAGO: Vulnerabilities in WAGO Device Manager

Severity

Medium

Notes

Summary: Vulnerabilities have been discovered in the WAGO Device Manager that allow any origin to access the server and set header values, as well as an endpoint that permits read access to the file system. The WAGO Device Manager is a software for configuring and parameterizing single WAGO products, which is included in the firmware. These vulnerabilities could be exploited by attackers to send requests and read server responses through crafted web applications or to access the file system.

Impact: The vulnerabilities in the WAGO Device Manager allow unauthorized access to server resources, data leakage, remote exploitation, and compromise of device integrity. Attackers can exploit these vulnerabilities to access sensitive information, perform malicious actions remotely, and identify additional weaknesses, potentially leading to data breaches and further security issues.

Remediation: Update to Firmware version 04.07.01 (FW29) or 03.10.11 (FW22 Patch 2). For the latest Custom Firmware please contact the WAGO support.

CVE-2025-25264

An unauthenticated remote attacker can trick an admin to visit a website containing malicious java script code. The current overly permissive CORS policy allows the attacker to obtain any files from the file system.

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CWE-942 - Permissive Cross-domain Policy with Untrusted Domains

Vendor Fix Update to Firmware version 04.07.01 (FW29) or 03.10.11 (FW22 Patch 2). For the latest Custom Firmware please contact the WAGO support.

CVE-2025-25265

A web application for configuring the controller is accessible at a specific path. It contains an endpoint that allows a high privileged remote attacker to read files from the system’s file structure.

4.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

CWE-306 - Missing Authentication for Critical Function

Vendor Fix Update to Firmware version 04.07.01 (FW29) or 03.10.11 (FW22 Patch 2). For the latest Custom Firmware please contact the WAGO support.

References

URL

Category

	https://www.wago.com/de-en/automation-technology/psirt	external
	https://certvde.com/de/advisories/vendor/wago/	external
	https://certvde.com/en/advisories/VDE-2025-018	self
	https://wago.csaf-tp.certvde.com/.well-known/csaf…	self

Acknowledgments

CERT@VDE certvde.com

JSON

To clipboard

{
  "document": {
    "acknowledgments": [
      {
        "organization": "CERT@VDE",
        "summary": "coordination",
        "urls": [
          "https://certvde.com"
        ]
      }
    ],
    "aggregate_severity": {
      "namespace": "https://www.first.org/cvss/v3.1/specification-document#Qualitative-Severity-Rating-Scale",
      "text": "Medium"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-GB",
    "notes": [
      {
        "category": "summary",
        "text": "Vulnerabilities have been discovered in the WAGO Device Manager that allow any origin to access the server and set header values, as well as an endpoint that permits read access to the file system. The WAGO Device Manager is a software for configuring and parameterizing single WAGO products, which is included in the firmware. These vulnerabilities could be exploited by attackers to send requests and read server responses through crafted web applications or to access the file system.",
        "title": "Summary"
      },
      {
        "category": "description",
        "text": "The vulnerabilities in the WAGO Device Manager allow unauthorized access to server resources, data leakage, remote exploitation, and compromise of device integrity. Attackers can exploit these vulnerabilities to access sensitive information, perform malicious actions remotely, and identify additional weaknesses, potentially leading to data breaches and further security issues.",
        "title": "Impact"
      },
      {
        "category": "description",
        "text": "Update to Firmware version 04.07.01 (FW29) or 03.10.11 (FW22 Patch 2). For the latest Custom Firmware please contact the WAGO support.",
        "title": "Remediation"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@wago.com",
      "name": "WAGO GmbH \u0026 Co. KG",
      "namespace": "https://www.wago.com/psirt"
    },
    "references": [
      {
        "category": "external",
        "summary": "WAGO PSIRT",
        "url": "https://www.wago.com/de-en/automation-technology/psirt"
      },
      {
        "category": "external",
        "summary": "CERT@VDE Security Advisories for WAGO",
        "url": "https://certvde.com/de/advisories/vendor/wago/"
      },
      {
        "category": "self",
        "summary": "VDE-2025-018: WAGO: Vulnerabilities in WAGO Device Manager - HTML",
        "url": "https://certvde.com/en/advisories/VDE-2025-018"
      },
      {
        "category": "self",
        "summary": "VDE-2025-018: WAGO: Vulnerabilities in WAGO Device Manager - CSAF",
        "url": "https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2025/vde-2025-018.json"
      }
    ],
    "title": "WAGO: Vulnerabilities in WAGO Device Manager",
    "tracking": {
      "aliases": [
        "VDE-2025-018"
      ],
      "current_release_date": "2025-11-21T12:00:00.000Z",
      "generator": {
        "date": "2025-11-21T11:28:39.863Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.5.38"
        }
      },
      "id": "VDE-2025-018",
      "initial_release_date": "2025-06-16T10:00:00.000Z",
      "revision_history": [
        {
          "date": "2025-06-16T10:00:00.000Z",
          "number": "1.0.0",
          "summary": "Initial release."
        },
        {
          "date": "2025-07-04T10:00:00.000Z",
          "number": "1.1.0",
          "summary": "Removed incorrect custom firmware versions."
        },
        {
          "date": "2025-10-07T08:00:00.000Z",
          "number": "1.1.1",
          "summary": "Fixed a typo in the description for CVE-2025-25264 "
        },
        {
          "date": "2025-11-21T12:00:00.000Z",
          "number": "1.2.0",
          "summary": "The two CVE descriptions and CVSS scores were edited."
        }
      ],
      "status": "final",
      "version": "1.2.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_name",
                    "name": "0751-9x01",
                    "product": {
                      "name": "CC100 0751-9x01",
                      "product_id": "CSAFPID-11001"
                    }
                  }
                ],
                "category": "product_family",
                "name": "CC100"
              },
              {
                "branches": [
                  {
                    "category": "product_name",
                    "name": "0750-810x/xxxx-xxxx",
                    "product": {
                      "name": "PFC100 G1 0750-810x/xxxx-xxxx",
                      "product_id": "CSAFPID-11002"
                    }
                  }
                ],
                "category": "product_family",
                "name": "PFC100 G1"
              },
              {
                "branches": [
                  {
                    "category": "product_name",
                    "name": "0750-811x-xxxx-xxxx",
                    "product": {
                      "name": "PFC100 G2 0750-811x-xxxx-xxxx",
                      "product_id": "CSAFPID-11003"
                    }
                  }
                ],
                "category": "product_family",
                "name": "PFC100 G2"
              },
              {
                "branches": [
                  {
                    "category": "product_name",
                    "name": "750-820x-xxx-xxx",
                    "product": {
                      "name": "PFC200 G1 750-820x-xxx-xxx",
                      "product_id": "CSAFPID-11004"
                    }
                  }
                ],
                "category": "product_family",
                "name": "PFC200 G1"
              },
              {
                "branches": [
                  {
                    "category": "product_name",
                    "name": "750-821x-xxx-xxx",
                    "product": {
                      "name": "PFC200 G2 750-821x-xxx-xxx",
                      "product_id": "CSAFPID-11005"
                    }
                  }
                ],
                "category": "product_family",
                "name": "PFC200 G2"
              },
              {
                "branches": [
                  {
                    "category": "product_name",
                    "name": "0762-420x/8000-000x",
                    "product": {
                      "name": "TP600 0762-420x/8000-000x",
                      "product_id": "CSAFPID-11006"
                    }
                  },
                  {
                    "category": "product_name",
                    "name": "0762-430x/8000-000x",
                    "product": {
                      "name": "TP600 0762-430x/8000-000x",
                      "product_id": "CSAFPID-11007"
                    }
                  },
                  {
                    "category": "product_name",
                    "name": "0762-520x/8000-000x",
                    "product": {
                      "name": "TP600 0762-520x/8000-000x",
                      "product_id": "CSAFPID-11008"
                    }
                  },
                  {
                    "category": "product_name",
                    "name": "0762-530x/8000-000x",
                    "product": {
                      "name": "TP600 0762-530x/8000-000x",
                      "product_id": "CSAFPID-11009"
                    }
                  },
                  {
                    "category": "product_name",
                    "name": "0762-620x/8000-000x",
                    "product": {
                      "name": "TP600 0762-620x/8000-000x",
                      "product_id": "CSAFPID-11010"
                    }
                  },
                  {
                    "category": "product_name",
                    "name": "0762-630x/8000-000x",
                    "product": {
                      "name": "TP600 0762-630x/8000-000x",
                      "product_id": "CSAFPID-11011"
                    }
                  }
                ],
                "category": "product_family",
                "name": "TP600"
              },
              {
                "branches": [
                  {
                    "category": "product_name",
                    "name": "0752-8303/8000-0002",
                    "product": {
                      "name": "Edge Controller 0752-8303/8000-0002",
                      "product_id": "CSAFPID-11012",
                      "product_identification_helper": {
                        "model_numbers": [
                          "0752-8303/8000-0002"
                        ]
                      }
                    }
                  }
                ],
                "category": "product_family",
                "name": "Edge Controller"
              }
            ],
            "category": "product_family",
            "name": "Hardware"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c04.07.01",
                "product": {
                  "name": "WAGO Firmware \u003c04.07.01 (FW29)",
                  "product_id": "CSAFPID-21001"
                }
              },
              {
                "category": "product_name",
                "name": "04.07.01",
                "product": {
                  "name": "WAGO Firmware 04.07.01 (FW29)",
                  "product_id": "CSAFPID-22001"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c03.10.11",
                "product": {
                  "name": "WAGO Firmware \u003c3.10.11 (FW22 Patch 2)",
                  "product_id": "CSAFPID-21002"
                }
              },
              {
                "category": "product_version",
                "name": "03.10.11",
                "product": {
                  "name": "WAGO Firmware 03.10.11 (FW22 Patch 2)",
                  "product_id": "CSAFPID-22002"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c04.07.01 (70)",
                "product": {
                  "name": "Custom Firmware \u003c04.07.01 (70)",
                  "product_id": "CSAFPID-21003"
                }
              },
              {
                "category": "product_version",
                "name": "04.07.01 (70)",
                "product": {
                  "name": "Custom Firmware 04.07.01 (70)",
                  "product_id": "CSAFPID-22003"
                }
              }
            ],
            "category": "product_family",
            "name": "Firmware"
          }
        ],
        "category": "vendor",
        "name": "WAGO"
      }
    ],
    "product_groups": [
      {
        "group_id": "CSAFGID-0001",
        "product_ids": [
          "CSAFPID-31001",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004",
          "CSAFPID-31005",
          "CSAFPID-31006",
          "CSAFPID-31007",
          "CSAFPID-31008",
          "CSAFPID-31009",
          "CSAFPID-31010",
          "CSAFPID-31011",
          "CSAFPID-31012",
          "CSAFPID-31013",
          "CSAFPID-31015",
          "CSAFPID-31017",
          "CSAFPID-31018",
          "CSAFPID-31019",
          "CSAFPID-31020",
          "CSAFPID-31021",
          "CSAFPID-31022",
          "CSAFPID-31023",
          "CSAFPID-31024"
        ],
        "summary": "Affected products."
      },
      {
        "group_id": "CSAFGID-0002",
        "product_ids": [
          "CSAFPID-32001",
          "CSAFPID-32002",
          "CSAFPID-32003",
          "CSAFPID-32004",
          "CSAFPID-32005",
          "CSAFPID-32006",
          "CSAFPID-32007",
          "CSAFPID-32008",
          "CSAFPID-32009",
          "CSAFPID-32010",
          "CSAFPID-32011",
          "CSAFPID-32012",
          "CSAFPID-32013",
          "CSAFPID-32015",
          "CSAFPID-32017",
          "CSAFPID-32018",
          "CSAFPID-32019",
          "CSAFPID-32020",
          "CSAFPID-32021",
          "CSAFPID-32022",
          "CSAFPID-32023",
          "CSAFPID-32024"
        ],
        "summary": "Fixed products."
      }
    ],
    "relationships": [
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "WAGO Firmware \u003c04.07.01 (FW29) installed on CC100 0751-9x01",
          "product_id": "CSAFPID-31001"
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11001"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "WAGO Firmware \u003c3.10.11 (FW22 Patch 2) installed on PFC100 G1 0750-810x/xxxx-xxxx",
          "product_id": "CSAFPID-31002"
        },
        "product_reference": "CSAFPID-21002",
        "relates_to_product_reference": "CSAFPID-11002"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "WAGO Firmware \u003c04.07.01 (FW29) installed on PFC100 G2 0750-811x-xxxx-xxxx",
          "product_id": "CSAFPID-31003"
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11003"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "WAGO Firmware \u003c3.10.11 (FW22 Patch 2) installed on PFC200 G1 750-820x-xxx-xxx",
          "product_id": "CSAFPID-31004"
        },
        "product_reference": "CSAFPID-21002",
        "relates_to_product_reference": "CSAFPID-11004"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "WAGO Firmware \u003c04.07.01 (FW29) installed on PFC200 G2 750-821x-xxx-xxx",
          "product_id": "CSAFPID-31005"
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11005"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "WAGO Firmware \u003c04.07.01 (FW29) installed on TP600 0762-420x/8000-000x",
          "product_id": "CSAFPID-31006"
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11006"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "WAGO Firmware \u003c04.07.01 (FW29) installed on TP600 0762-430x/8000-000x",
          "product_id": "CSAFPID-31007"
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11007"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "WAGO Firmware \u003c04.07.01 (FW29) installed on TP600 0762-520x/8000-000x",
          "product_id": "CSAFPID-31008"
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11008"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "WAGO Firmware \u003c04.07.01 (FW29) installed on TP600 0762-530x/8000-000x",
          "product_id": "CSAFPID-31009"
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11009"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "WAGO Firmware \u003c04.07.01 (FW29) installed on TP600 0762-620x/8000-000x",
          "product_id": "CSAFPID-31010"
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11010"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "WAGO Firmware \u003c04.07.01 (FW29) installed on TP600 0762-630x/8000-000x",
          "product_id": "CSAFPID-31011"
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11011"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "WAGO Firmware \u003c04.07.01 (FW29) installed on Edge Controller 0752-8303/8000-0002",
          "product_id": "CSAFPID-31012"
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11012"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "WAGO Firmware 04.07.01 (FW29) installed on CC100 0751-9x01",
          "product_id": "CSAFPID-32001"
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11001"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "WAGO Firmware 03.10.11 (FW22 Patch 2) installed on PFC100 G1 0750-810x/xxxx-xxxx",
          "product_id": "CSAFPID-32002"
        },
        "product_reference": "CSAFPID-22002",
        "relates_to_product_reference": "CSAFPID-11002"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "WAGO Firmware 04.07.01 (FW29) installed on PFC100 G2 0750-811x-xxxx-xxxx",
          "product_id": "CSAFPID-32003"
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11003"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "WAGO Firmware 03.10.11 (FW22 Patch 2) installed on PFC200 G1 750-820x-xxx-xxx",
          "product_id": "CSAFPID-32004"
        },
        "product_reference": "CSAFPID-22002",
        "relates_to_product_reference": "CSAFPID-11004"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "WAGO Firmware 04.07.01 (FW29) installed on PFC200 G2 750-821x-xxx-xxx",
          "product_id": "CSAFPID-32005"
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11005"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "WAGO Firmware 04.07.01 (FW29) installed on TP600 0762-420x/8000-000x",
          "product_id": "CSAFPID-32006"
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11006"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "WAGO Firmware 04.07.01 (FW29) installed on TP600 0762-430x/8000-000x",
          "product_id": "CSAFPID-32007"
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11007"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "WAGO Firmware 04.07.01 (FW29) installed on TP600 0762-520x/8000-000x",
          "product_id": "CSAFPID-32008"
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11008"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "WAGO Firmware 04.07.01 (FW29) installed on TP600 0762-530x/8000-000x",
          "product_id": "CSAFPID-32009"
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11009"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "WAGO Firmware 04.07.01 (FW29) installed on TP600 0762-620x/8000-000x",
          "product_id": "CSAFPID-32010"
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11010"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "WAGO Firmware 04.07.01 (FW29) installed on TP600 0762-630x/8000-000x",
          "product_id": "CSAFPID-32011"
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11011"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "WAGO Firmware 04.07.01 (FW29) installed on Edge Controller 0752-8303/8000-0002",
          "product_id": "CSAFPID-32012"
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11012"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Custom Firmware \u003c04.07.01 (70) installed on CC100 0751-9x01",
          "product_id": "CSAFPID-31013"
        },
        "product_reference": "CSAFPID-21003",
        "relates_to_product_reference": "CSAFPID-11001"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Custom Firmware \u003c04.07.01 (70) installed on PFC100 G2 0750-811x-xxxx-xxxx",
          "product_id": "CSAFPID-31015"
        },
        "product_reference": "CSAFPID-21003",
        "relates_to_product_reference": "CSAFPID-11003"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Custom Firmware \u003c04.07.01 (70) installed on PFC200 G2 750-821x-xxx-xxx",
          "product_id": "CSAFPID-31017"
        },
        "product_reference": "CSAFPID-21003",
        "relates_to_product_reference": "CSAFPID-11005"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Custom Firmware \u003c04.07.01 (70) installed on TP600 0762-420x/8000-000x",
          "product_id": "CSAFPID-31018"
        },
        "product_reference": "CSAFPID-21003",
        "relates_to_product_reference": "CSAFPID-11006"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Custom Firmware \u003c04.07.01 (70) installed on TP600 0762-430x/8000-000x",
          "product_id": "CSAFPID-31019"
        },
        "product_reference": "CSAFPID-21003",
        "relates_to_product_reference": "CSAFPID-11007"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Custom Firmware \u003c04.07.01 (70) installed on TP600 0762-520x/8000-000x",
          "product_id": "CSAFPID-31020"
        },
        "product_reference": "CSAFPID-21003",
        "relates_to_product_reference": "CSAFPID-11008"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Custom Firmware \u003c04.07.01 (70) installed on TP600 0762-530x/8000-000x",
          "product_id": "CSAFPID-31021"
        },
        "product_reference": "CSAFPID-21003",
        "relates_to_product_reference": "CSAFPID-11009"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Custom Firmware \u003c04.07.01 (70) installed on TP600 0762-620x/8000-000x",
          "product_id": "CSAFPID-31022"
        },
        "product_reference": "CSAFPID-21003",
        "relates_to_product_reference": "CSAFPID-11010"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Custom Firmware \u003c04.07.01 (70) installed on TP600 0762-630x/8000-000x",
          "product_id": "CSAFPID-31023"
        },
        "product_reference": "CSAFPID-21003",
        "relates_to_product_reference": "CSAFPID-11011"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Custom Firmware \u003c04.07.01 (70) installed on Edge Controller 0752-8303/8000-0002",
          "product_id": "CSAFPID-31024"
        },
        "product_reference": "CSAFPID-21003",
        "relates_to_product_reference": "CSAFPID-11012"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Custom Firmware 04.07.01 (70) installed on CC100 0751-9x01",
          "product_id": "CSAFPID-32013"
        },
        "product_reference": "CSAFPID-22003",
        "relates_to_product_reference": "CSAFPID-11001"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Custom Firmware 04.07.01 (70) installed on PFC100 G2 0750-811x-xxxx-xxxx",
          "product_id": "CSAFPID-32015"
        },
        "product_reference": "CSAFPID-22003",
        "relates_to_product_reference": "CSAFPID-11003"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Custom Firmware 04.07.01 (70) installed on PFC200 G2 750-821x-xxx-xxx",
          "product_id": "CSAFPID-32017"
        },
        "product_reference": "CSAFPID-22003",
        "relates_to_product_reference": "CSAFPID-11005"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Custom Firmware 04.07.01 (70) installed on TP600 0762-420x/8000-000x",
          "product_id": "CSAFPID-32018"
        },
        "product_reference": "CSAFPID-22003",
        "relates_to_product_reference": "CSAFPID-11006"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Custom Firmware 04.07.01 (70) installed on TP600 0762-430x/8000-000x",
          "product_id": "CSAFPID-32019"
        },
        "product_reference": "CSAFPID-22003",
        "relates_to_product_reference": "CSAFPID-11007"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Custom Firmware 04.07.01 (70) installed on TP600 0762-520x/8000-000x",
          "product_id": "CSAFPID-32020"
        },
        "product_reference": "CSAFPID-22003",
        "relates_to_product_reference": "CSAFPID-11008"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Custom Firmware 04.07.01 (70) installed on TP600 0762-530x/8000-000x",
          "product_id": "CSAFPID-32021"
        },
        "product_reference": "CSAFPID-22003",
        "relates_to_product_reference": "CSAFPID-11009"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Custom Firmware 04.07.01 (70) installed on TP600 0762-620x/8000-000x",
          "product_id": "CSAFPID-32022"
        },
        "product_reference": "CSAFPID-22003",
        "relates_to_product_reference": "CSAFPID-11010"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Custom Firmware 04.07.01 (70) installed on TP600 0762-630x/8000-000x",
          "product_id": "CSAFPID-32023"
        },
        "product_reference": "CSAFPID-22003",
        "relates_to_product_reference": "CSAFPID-11011"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Custom Firmware 04.07.01 (70) installed on Edge Controller 0752-8303/8000-0002",
          "product_id": "CSAFPID-32024"
        },
        "product_reference": "CSAFPID-22003",
        "relates_to_product_reference": "CSAFPID-11012"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-25264",
      "cwe": {
        "id": "CWE-942",
        "name": "Permissive Cross-domain Policy with Untrusted Domains"
      },
      "notes": [
        {
          "category": "description",
          "text": "An unauthenticated remote attacker can trick an admin to visit a website containing malicious java script code. The current overly permissive CORS policy allows the attacker to obtain any files from the file system. ",
          "title": "CVE Description"
        },
        {
          "category": "details",
          "text": "The current CORS configuration allows the setting of the header values relevant for authentication, as well as the access and reading of HTTP responses, starting from any origins. This can lead to attackers preparing a corresponding Web application, which can be accessed via the Internet, for example, in such a way that they transmit relevant HTTP requests in the background against the Web application running on the controller.",
          "title": "CVE Details"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-32001",
          "CSAFPID-32002",
          "CSAFPID-32003",
          "CSAFPID-32004",
          "CSAFPID-32005",
          "CSAFPID-32006",
          "CSAFPID-32007",
          "CSAFPID-32008",
          "CSAFPID-32009",
          "CSAFPID-32010",
          "CSAFPID-32011",
          "CSAFPID-32012",
          "CSAFPID-32013",
          "CSAFPID-32015",
          "CSAFPID-32017",
          "CSAFPID-32018",
          "CSAFPID-32019",
          "CSAFPID-32020",
          "CSAFPID-32021",
          "CSAFPID-32022",
          "CSAFPID-32023",
          "CSAFPID-32024"
        ],
        "known_affected": [
          "CSAFPID-31001",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004",
          "CSAFPID-31005",
          "CSAFPID-31006",
          "CSAFPID-31007",
          "CSAFPID-31008",
          "CSAFPID-31009",
          "CSAFPID-31010",
          "CSAFPID-31011",
          "CSAFPID-31012",
          "CSAFPID-31013",
          "CSAFPID-31015",
          "CSAFPID-31017",
          "CSAFPID-31018",
          "CSAFPID-31019",
          "CSAFPID-31020",
          "CSAFPID-31021",
          "CSAFPID-31022",
          "CSAFPID-31023",
          "CSAFPID-31024"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to Firmware version 04.07.01 (FW29) or 03.10.11 (FW22 Patch 2). For the latest Custom Firmware please contact the WAGO support.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 6.5,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 6.5,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-31001",
            "CSAFPID-31002",
            "CSAFPID-31003",
            "CSAFPID-31004",
            "CSAFPID-31005",
            "CSAFPID-31006",
            "CSAFPID-31007",
            "CSAFPID-31008",
            "CSAFPID-31009",
            "CSAFPID-31010",
            "CSAFPID-31011",
            "CSAFPID-31012",
            "CSAFPID-31013",
            "CSAFPID-31015",
            "CSAFPID-31017",
            "CSAFPID-31018",
            "CSAFPID-31019",
            "CSAFPID-31020",
            "CSAFPID-31021",
            "CSAFPID-31022",
            "CSAFPID-31023",
            "CSAFPID-31024"
          ]
        }
      ],
      "title": "CVE-2025-25264"
    },
    {
      "cve": "CVE-2025-25265",
      "cwe": {
        "id": "CWE-306",
        "name": "Missing Authentication for Critical Function"
      },
      "notes": [
        {
          "category": "description",
          "text": "A web application for configuring the controller is accessible at a specific path. It contains an endpoint that allows a high privileged remote attacker to read files from the system\u2019s file structure.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-32001",
          "CSAFPID-32002",
          "CSAFPID-32003",
          "CSAFPID-32004",
          "CSAFPID-32005",
          "CSAFPID-32006",
          "CSAFPID-32007",
          "CSAFPID-32008",
          "CSAFPID-32009",
          "CSAFPID-32010",
          "CSAFPID-32011",
          "CSAFPID-32012",
          "CSAFPID-32013",
          "CSAFPID-32015",
          "CSAFPID-32017",
          "CSAFPID-32018",
          "CSAFPID-32019",
          "CSAFPID-32020",
          "CSAFPID-32021",
          "CSAFPID-32022",
          "CSAFPID-32023",
          "CSAFPID-32024"
        ],
        "known_affected": [
          "CSAFPID-31001",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004",
          "CSAFPID-31005",
          "CSAFPID-31006",
          "CSAFPID-31007",
          "CSAFPID-31008",
          "CSAFPID-31009",
          "CSAFPID-31010",
          "CSAFPID-31011",
          "CSAFPID-31012",
          "CSAFPID-31013",
          "CSAFPID-31015",
          "CSAFPID-31017",
          "CSAFPID-31018",
          "CSAFPID-31019",
          "CSAFPID-31020",
          "CSAFPID-31021",
          "CSAFPID-31022",
          "CSAFPID-31023",
          "CSAFPID-31024"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to Firmware version 04.07.01 (FW29) or 03.10.11 (FW22 Patch 2). For the latest Custom Firmware please contact the WAGO support.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 4.9,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "temporalScore": 4.9,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-31001",
            "CSAFPID-31002",
            "CSAFPID-31003",
            "CSAFPID-31004",
            "CSAFPID-31005",
            "CSAFPID-31006",
            "CSAFPID-31007",
            "CSAFPID-31008",
            "CSAFPID-31009",
            "CSAFPID-31010",
            "CSAFPID-31011",
            "CSAFPID-31012",
            "CSAFPID-31013",
            "CSAFPID-31015",
            "CSAFPID-31017",
            "CSAFPID-31018",
            "CSAFPID-31019",
            "CSAFPID-31020",
            "CSAFPID-31021",
            "CSAFPID-31022",
            "CSAFPID-31023",
            "CSAFPID-31024"
          ]
        }
      ],
      "title": "CVE-2025-25265"
    }
  ]
}

CVE-2025-25265 (GCVE-0-2025-25265)

Vulnerability from cvelistv5 – Published: 2025-06-16 09:46 – Updated: 2025-11-21 11:38

Title

Unauthenticated File Read via Web Interface

Summary

Severity ?

4.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-306 - Missing Authentication for Critical Function

Assigner

CERTVDE

References

URL

Tags

https://certvde.com/en/advisories/VDE-2025-018/

Impacted products

Vendor

Product

Version

WAGO

WAGO CC100 0751-9x01

Affected: 0.0.0 , < 04.07.01 (FW29) (semver)

WAGO	CC100 0751-9x01	Affected: 0.0.0 , < 04.07.01 (70) (semver)
WAGO	PFC100 G1 0750-810x/xxxx-xxxx	Affected: 0.0.0 , < 3.10.11 (FW22 Patch 2) (semver)
WAGO	PFC100 G2 0750-811x-xxxx-xxxx	Affected: 0.0.0 , < 04.07.01 (FW29) (semver)
WAGO	PFC100 G2 0750-811x-xxxx-xxxx	Affected: 0.0.0 , < 04.07.01 (70) (semver)
WAGO	PFC200 G1 750-820x-xxx-xxx	Affected: 0.0.0 , < 3.10.11 (FW22 Patch 2) (semver)
WAGO	PFC200 G2 750-821x-xxx-xxx	Affected: 0.0.0 , < 04.07.01 (FW29) (semver)
WAGO	PFC200 G2 750-821x-xxx-xxx	Affected: 0.0.0 , < 04.07.01 (70) (semver)
WAGO	TP600 0762-420x/8000-000x	Affected: 0.0.0 , < 04.07.01 (FW29) (semver)
WAGO	TP600 0762-420x/8000-000x	Affected: 0.0.0 , < 04.07.01 (70) (semver)
WAGO	TP600 0762-430x/8000-000x	Affected: 0.0.0 , < 04.07.01 (FW29) (semver)
WAGO	TP600 0762-430x/8000-000x	Affected: 0.0.0 , < 04.07.01 (70) (semver)
WAGO	TP600 0762-520x/8000-000x	Affected: 0.0.0 , < 04.07.01 (FW29) (semver)
WAGO	TP600 0762-520x/8000-000x	Affected: 0.0.0 , < 04.07.01 (70) (semver)
WAGO	TP600 0762-530x/8000-000x	Affected: 0.0.0 , < 04.07.01 (FW29) (semver)
WAGO	TP600 0762-530x/8000-000x	Affected: 0.0.0 , < 04.07.01 (70) (semver)
WAGO	TP600 0762-620x/8000-000x	Affected: 0.0.0 , < 04.07.01 (FW29) (semver)
WAGO	TP600 0762-620x/8000-000x	Affected: 0.0.0 , < 04.07.01 (70) (semver)
WAGO	TP600 0762-630x/8000-000x	Affected: 0.0.0 , < 04.07.01 (FW29) (semver)
WAGO	TP600 0762-630x/8000-000x	Affected: 0.0.0 , < 04.07.01 (70) (semver)
WAGO	Edge Controller 0752-8303/8000-0002	Affected: 0.0.0 , < 04.07.01 (FW29) (semver)
WAGO	Edge Controller 0752-8303/8000-0002	Affected: 0.0.0 , < 04.07.01 (70) (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-25265",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-16T18:12:43.011626Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-16T18:13:49.552Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WAGO CC100 0751-9x01",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThan": "04.07.01 (FW29)",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CC100 0751-9x01",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThan": "04.07.01 (70)",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "PFC100 G1 0750-810x/xxxx-xxxx",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThan": "3.10.11 (FW22 Patch 2)",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "PFC100 G2 0750-811x-xxxx-xxxx",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThan": "04.07.01 (FW29)",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "PFC100 G2 0750-811x-xxxx-xxxx",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThan": "04.07.01 (70)",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "PFC200 G1 750-820x-xxx-xxx",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThan": "3.10.11 (FW22 Patch 2)",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "PFC200 G2 750-821x-xxx-xxx",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThan": "04.07.01 (FW29)",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "PFC200 G2 750-821x-xxx-xxx",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThan": "04.07.01 (70)",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TP600 0762-420x/8000-000x",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThan": "04.07.01 (FW29)",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TP600 0762-420x/8000-000x",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThan": "04.07.01 (70)",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TP600 0762-430x/8000-000x",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThan": "04.07.01 (FW29)",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TP600 0762-430x/8000-000x",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThan": "04.07.01 (70)",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TP600 0762-520x/8000-000x",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThan": "04.07.01 (FW29)",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TP600 0762-520x/8000-000x",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThan": "04.07.01 (70)",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TP600 0762-530x/8000-000x",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThan": "04.07.01 (FW29)",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TP600 0762-530x/8000-000x",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThan": "04.07.01 (70)",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TP600 0762-620x/8000-000x",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThan": "04.07.01 (FW29)",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TP600 0762-620x/8000-000x",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThan": "04.07.01 (70)",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TP600 0762-630x/8000-000x",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThan": "04.07.01 (FW29)",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TP600 0762-630x/8000-000x",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThan": "04.07.01 (70)",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Edge Controller 0752-8303/8000-0002",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThan": "04.07.01 (FW29)",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Edge Controller 0752-8303/8000-0002",
          "vendor": "WAGO",
          "versions": [
            {
              "lessThan": "04.07.01 (70)",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A web application for configuring the controller is accessible at a specific path. It contains an endpoint that allows a high privileged remote attacker to read files from the system\u2019s file structure.\u003cbr\u003e"
            }
          ],
          "value": "A web application for configuring the controller is accessible at a specific path. It contains an endpoint that allows a high privileged remote attacker to read files from the system\u2019s file structure."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306 Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-21T11:38:18.852Z",
        "orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
        "shortName": "CERTVDE"
      },
      "references": [
        {
          "url": "https://certvde.com/en/advisories/VDE-2025-018/"
        }
      ],
      "source": {
        "advisory": "VDE-2025-018",
        "defect": [
          "CERT@VDE#641748"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Unauthenticated File Read via Web Interface",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
    "assignerShortName": "CERTVDE",
    "cveId": "CVE-2025-25265",
    "datePublished": "2025-06-16T09:46:13.998Z",
    "dateReserved": "2025-02-06T12:30:08.318Z",
    "dateUpdated": "2025-11-21T11:38:18.852Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-25264 (GCVE-0-2025-25264)

Vulnerability from cvelistv5 – Published: 2025-06-16 09:45 – Updated: 2025-11-21 11:36

Title

Overly Permissive CORS Policy in WAGO Device Manager

Summary

Severity ?

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CWE

CWE-942 - Permissive Cross-domain Policy with Untrusted Domains

Assigner

CERTVDE

References

URL

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

VDE-2025-018

CVE-2025-25265 (GCVE-0-2025-25265)

CVE-2025-25264 (GCVE-0-2025-25264)

Tags

Sightings

Nomenclature