WAGO: Multiple Devices are affected by a Vulnerability in BACnet IP Stack
Plan PatchCVSS 9.8VDE-2025-102Oct 1, 2026
WAGO
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary
A path traversal vulnerability exists in the BACnet File Object creation mechanism on multiple WAGO devices. The object name is used directly as a file path without validation, allowing an attacker to use relative path sequences (../) to access and manipulate files outside the intended BACnet directory. All firmware versions from 1.0.0 to below 4.8.9 on affected device models are vulnerable. No patch is currently available for any affected product.
What this means
What could happen
An attacker with network access to the BACnet interface could read, write, or delete arbitrary files on the affected WAGO controller, potentially disrupting control logic, stealing configuration data, or causing the device to stop responding to plant operations.
Who's at risk
This affects operators of WAGO industrial controllers used in building automation, water treatment, power distribution, and manufacturing environments. Specifically impacts CC100, PFC100 G2, PFC200 G2, TP600, WP400 panel PCs, and Edge Controller 0752-8303 devices that use BACnet for communications.
How it could be exploited
An attacker sends a specially crafted BACnet request to create a File Object with a path traversal string (e.g., "../../etc/passwd") in the object name. The device does not validate the path, allowing the attacker to read or write files outside the intended BACnet directory. This can be done over the network to any device with BACnet IP enabled and reachable.
Prerequisites
- Network access to the BACnet IP interface (typically UDP port 47808)
- BACnet File Object functionality must be enabled on the device
- No authentication is required to send BACnet requests
remotely exploitableno authentication requiredlow complexityno patch availablecritical CVSS (9.8)
Exploitability
Unlikely to be exploited — EPSS score 0.6%
Affected products (22)
22 EOL
ProductAffected VersionsFix Status
CC100 0751-9x01≥ 1.0.0, < 4.8.9No fix (EOL)
CC100 0751-9x01≥ 1.0.0, < 4.8.9 (70)No fix (EOL)
PFC100 G2 0750-811x-xxxx-xxxx≥ 1.0.0, < 4.8.9No fix (EOL)
PFC100 G2 0750-811x-xxxx-xxxx≥ 1.0.0, < 4.8.9 (70)No fix (EOL)
PFC200 G2 0750-821x-xxx-xxx≥ 1.0.0, < 4.8.9No fix (EOL)
Remediation & Mitigation
0/4
Do now
0/3HOTFIXUpdate all affected WAGO devices to firmware version 4.8.9 (FW30) or higher as soon as possible. Contact WAGO support for custom firmware if standard updates are not available for your specific hardware variant.
WORKAROUNDIf firmware update cannot be applied immediately, restrict network access to the BACnet IP port (UDP 47808) using firewall rules to allow only trusted engineering workstations and control systems.
HARDENINGDisable BACnet File Object functionality if it is not required for plant operations.
Mitigations - no patch available
0/1The following products have reached End of Life with no planned fix: CC100 0751-9x01, CC100 0751-9x01, PFC100 G2 0750-811x-xxxx-xxxx, PFC100 G2 0750-811x-xxxx-xxxx, PFC200 G2 0750-821x-xxx-xxx, PFC200 G2 0750-821x-xxx-xxx, TP600 0762-420x-8000-000x, TP600 0762-420x-8000-000x, TP600 0762-430x-8000-000x, TP600 0762-430x-8000-000x, TP600 0762-520x-8000-000x, TP600 0762-520x-8000-000x, TP600 0762-530x-8000-000x, TP600 0762-530x-8000-000x, TP600 0762-620x-8000-000x, TP600 0762-620x-8000-000x, TP600 0762-630x-8000-000x, TP600 0762-630x-8000-000x, Edge Controller 0752-8303-8000-0002, Edge Controller 0752-8303-8000-0002, WP400 0762-340x, WP400 0762-340x. Apply the following compensating controls:
HARDENINGSegment the network so that WAGO controllers are not directly reachable from untrusted networks or the internet.
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/e7e5e674-869f-40ae-97e0-cf9e7d6f8c4aGet OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.