WAGO: Multiple Devices are affected by a Vulnerability in BACnet IP Stack
view advisory published 2026-10-01
Multiple WAGO devices are affected by a vulnerability in the dynamic creation of BACnet File Objects. The object name is used as a file path without sufficient validation and is not restricted to the intended directory, so relative paths can be used to reach files elsewhere in the file system.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-41753US | critical9.8 | — | ||
The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation. Because relative paths are not limited to the intended dire… | ||||
02
references
External citations — patches, advisories, analysis.
03
remediations (1)
- Fixed
Update to Firmware version 4.8.9 (FW30) or higher. For the latest custom Firmware please contact the WAGO support.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan