WAGO: Multiple PLCs and Communication Components are Affected by multiple Vulnerabilities leading to RCE
Plan PatchCVSS 8.3VDE-2025-081Oct 1, 2026
CODESYSWAGOManufacturing
Attack path
Attack VectorNetwork
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
Multiple WAGO PLCs and communication devices (CC100, PFC100 G2, PFC200 G2, TP600, Edge Controller, WP400) running firmware versions below 4.10.0 are affected by CODESYS Control vulnerabilities (CWE-502, CWE-843, CWE-125) that allow remote code execution with low complexity and low authentication requirements. Affected firmware includes FW32 versions below 4.10.0 and custom firmware (70) versions below 4.10.0.
What this means
What could happen
An attacker with limited network access and basic credentials could execute arbitrary commands on WAGO PLCs, allowing them to alter process parameters, disable safety functions, or halt production operations. This affects programmable logic controllers and edge devices across manufacturing environments.
Who's at risk
Manufacturing facilities using WAGO industrial controllers should review their deployments immediately. Affected products include CC100 compact controllers, PFC100/200 G2 programmable field controllers, TP600 touch panel terminals, Edge Controller units, and WP400 wireless panels. All versions below 4.10.0 are vulnerable regardless of firmware variant (FW32 or custom 70).
How it could be exploited
An attacker on the network reaches a WAGO device running vulnerable firmware, provides valid but low-privilege credentials, and exploits the CODESYS runtime vulnerabilities to execute commands with PLC privileges. This allows modification of control logic or operational parameters without authorization.
Prerequisites
- Network access to the WAGO device
- Valid user credentials (low privilege required based on CVSS PR:L)
- Device running firmware version below 4.10.0 (FW32) or below 4.10.0 (70)
Remotely exploitableLow authentication requiredLow attack complexityNo patch available for affected versionsAffects manufacturing control systems
Exploitability
Unlikely to be exploited — EPSS score 0.4%
Affected products (22)
22 with fix
ProductAffected VersionsFix Status
PFC100 G2 0750-811x-xxxx-xxxx≥ 1.0.0, < 4.10.04.10.0 (FW32)+
PFC200 G2 750-821x-xxx-xxx≥ 1.0.0, < 4.10.04.10.0 (FW32)+
PFC200 G2 750-821x-xxx-xxx≥ 1.0.0, < 4.10.0 (70)4.10.0 (FW32)+
TP600 0762-420x/8000-000x≥ 1.0.0, < 4.10.04.10.0 (FW32)+
TP600 0762-430x/8000-000x≥ 1.0.0, < 4.10.04.10.0 (FW32)+
Remediation & Mitigation
0/5
Do now
0/2WORKAROUNDRestrict network access to WAGO devices to authorized engineering workstations and control systems only using firewall rules
HARDENINGEnforce strong credentials and disable default accounts on all WAGO devices
Schedule — requires maintenance window
0/2Patching may require device reboot — plan for process interruption
HOTFIXUpdate all WAGO devices to firmware version 4.10.0 (FW32) or later
HOTFIXFor custom firmware (70) devices, contact WAGO support to obtain version 4.10.0 (70) or equivalent patched firmware
Long-term hardening
0/1HARDENINGImplement network segmentation to isolate WAGO PLCs from general corporate networks
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/9dd1981a-5a97-40aa-a03c-a0c4369fc5abGet OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.