{
  "document": {
    "acknowledgments": [
      {
        "organization": "CERTVDE",
        "summary": "coordination",
        "urls": [
          "https://certvde.com"
        ]
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-GB",
    "notes": [
      {
        "category": "summary",
        "text": "During installation, identical certificates are installed across all systems instead of unique ones, which are intended for JWT Token encryption and signing.",
        "title": "Summary"
      },
      {
        "category": "description",
        "text": "The system installs identical JWT signing certificates on all installations instead of generating unique ones. This allows anyone with the shared key to forge valid tokens and impersonate users across all systems, compromising security.",
        "title": "Impact"
      },
      {
        "category": "description",
        "text": "Update to WAGO Device Sphere version 1.0.1. WAGO Device Sphere version 1.0 can\u0027t be used after the 30.06.2025.",
        "title": "Remediation"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@wago.com",
      "name": "WAGO GmbH \u0026 Co. KG",
      "namespace": "https://www.wago.com/psirt"
    },
    "references": [
      {
        "category": "self",
        "summary": "WAGO PSIRT",
        "url": "https://www.wago.com/de-en/automation-technology/psirt"
      },
      {
        "category": "external",
        "summary": "CERT@VDE Security Advisories for WAGO",
        "url": "https://certvde.com/de/advisories/vendor/wago/"
      },
      {
        "category": "self",
        "summary": "VDE-2025-057: WAGO: Vulnerability in WAGO Device Sphere - HTML",
        "url": "https://certvde.com/en/advisories/VDE-2025-057"
      },
      {
        "category": "self",
        "summary": "VDE-2025-057: WAGO: Vulnerability in WAGO Device Sphere - CSAF",
        "url": "https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2025/vde-2025-057.json"
      }
    ],
    "title": "WAGO: Vulnerability in WAGO Device Sphere",
    "tracking": {
      "aliases": [
        "VDE-2025-057"
      ],
      "current_release_date": "2025-07-07T06:15:00.000Z",
      "generator": {
        "date": "2025-07-07T06:20:44.795Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.5.29"
        }
      },
      "id": "VDE-2025-057",
      "initial_release_date": "2025-06-23T10:00:00.000Z",
      "revision_history": [
        {
          "date": "2025-06-12T07:00:00.000Z",
          "number": "1.0.0",
          "summary": "Initial release."
        },
        {
          "date": "2025-07-07T06:15:00.000Z",
          "number": "1.0.1",
          "summary": "fixed typo in CVE-ID"
        }
      ],
      "status": "final",
      "version": "1.0.1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003c1.0.1",
                    "product": {
                      "name": "WAGO Software Device Sphere \u003c1.0.1",
                      "product_id": "CSAFPID-21001"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "1.0.1",
                    "product": {
                      "name": "WAGO Software Device Sphere 1.0.1",
                      "product_id": "CSAFPID-22001"
                    }
                  }
                ],
                "category": "product_name",
                "name": "Device Sphere"
              }
            ],
            "category": "product_name",
            "name": "Software"
          }
        ],
        "category": "vendor",
        "name": "WAGO"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-41672",
      "cwe": {
        "id": "CWE-1188",
        "name": "Initialization of a Resource with an Insecure Default"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "A remote unauthenticated attacker may use default certificates to generate JWT Tokens and gain full access to the tool and all connected devices.",
          "title": "Vulnerability Description"
        },
        {
          "category": "details",
          "text": "During installation, contrary to the  manual, two certificates are permanently installed rather than being generated. As a result, each installation has the same two certificates. These certificates are intended for the encryption and signature of JWT Tokens. Currently, JWTs are not encrypted, so the encryption certificate is not in use, while the signature certificate is active.",
          "title": "Vulnerability Details"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-22001"
        ],
        "known_affected": [
          "CSAFPID-21001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-06-05T09:00:00.000Z",
          "details": "Update to WAGO Device Sphere version 1.0.1. WAGO Device Sphere version 1.0 can\u0027t be used after the 30.06.2025.",
          "product_ids": [
            "CSAFPID-21001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 10,
            "environmentalSeverity": "CRITICAL",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "temporalScore": 10,
            "temporalSeverity": "CRITICAL",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-21001"
          ]
        }
      ],
      "title": "CVE-2025-41672"
    }
  ]
}