CVE-2023-4089

lowpriority · track · 0EPSS 0.006 · 50 %ileDEEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.63% (50th) EPSS

CVSS 2.7 · low

Is it mine?

83 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · scored 2026-10-27

On affected Wago products an remote attacker with administrative privileges can access files to which he has already access to through an undocumented local file inclusion. This access is logged in a different log file than expected.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixedwago_psirt
Update to Firmware 4.7.1 (FW29), Firmware 03.10.11 (FW22 Patch 2). For the latest Custom Firmware, please contact the WAGO support.
MitigationCompact Controller CC100cisa_csaf_ot
As general security measures strongly WAGO recommends:
MitigationEdge Controllercisa_csaf_ot
As general security measures strongly WAGO recommends:
MitigationPFC100cisa_csaf_ot
As general security measures strongly WAGO recommends:
MitigationPFC200cisa_csaf_ot
As general security measures strongly WAGO recommends:
MitigationTouch Panel 600 Advanced Linecisa_csaf_ot
As general security measures strongly WAGO recommends:
MitigationTouch Panel 600 Marine Linecisa_csaf_ot
As general security measures strongly WAGO recommends:
MitigationTouch Panel 600 Standard Linecisa_csaf_ot
As general security measures strongly WAGO recommends:

cvss

Technical severity, 0–10. One row per scoring source.

2.7

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.12.7lowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:Nsecondary · CISA US

v3.12.7lowAV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:Nsecondary · FSTEC (BDU) RU

v3.12.7lowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:Nsecondary · ENISA EU

v3.12.7lowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:Nsecondary · info@cert.vde.comexploitability 1.2 · impact 1.4

v3.12.7lowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:Nsecondary · WAGO PSIRT DE

v3.12.5lowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-610USCWE-610USCWE-610USCWE-610US

affected products (83)

Products and version ranges known to be affected.

Compact Controller CC100: >FW19_up_to_and_including_FW26all versionscisa_csaf_otUS
Edge Controller: >FW18_up_to_and_including_FW26all versionscisa_csaf_otUS
PFC100: >FW16_up_to_and_including_FW26all versionscisa_csaf_otUS
PFC200: >FW16_up_to_and_including_FW26all versionscisa_csaf_otUS
Touch Panel 600 Advanced Line: >FW16_up_to_and_including_FW26all versionscisa_csaf_otUS
Touch Panel 600 Marine Line: >FW16_up_to_and_including_FW26all versionscisa_csaf_otUS
Touch Panel 600 Standard Line: >FW16_up_to_and_including_FW26all versionscisa_csaf_otUS
WAGO Compact Controller CC100≥ FW19_up_to_and_including_FW26cisa_csaf_otUS
WAGO Edge Controller≥ FW18_up_to_and_including_FW26cisa_csaf_otUS
WAGO PFC100≥ FW16_up_to_and_including_FW26cisa_csaf_otUS
WAGO PFC200≥ FW16_up_to_and_including_FW26cisa_csaf_otUS
WAGO Touch Panel 600 Advanced Line≥ FW16_up_to_and_including_FW26cisa_csaf_otUS
WAGO Touch Panel 600 Marine Line≥ FW16_up_to_and_including_FW26cisa_csaf_otUS
WAGO Touch Panel 600 Standard Line≥ FW16_up_to_and_including_FW26cisa_csaf_otUS
WAGO Compact Controller CC100≤ FW19 ≤FW26enisa_euvdEU
WAGO Edge Controller≤ FW18 ≤FW26enisa_euvdEU
WAGO PFC100≤ FW16 ≤FW26enisa_euvdEU
WAGO PFC200≤ FW16 ≤FW26enisa_euvdEU
WAGO Touch Panel 600 Advanced Line≤ FW16 ≤FW26enisa_euvdEU
WAGO Touch Panel 600 Marine Line≤ FW16 ≤FW26enisa_euvdEU

showing 20 of 83

advisories (2)

Vendor and ecosystem advisories describing this.

VDE-2023-046WAGO: Multiple products vulnerable to local file inclusion2023-10-23csaf · wago_psirtDE
An attacker with administrative privileges which can access sensitive files, can additionally access them in an unintended, undocumented way.
ICSA-23-325-01WAGO PFC200 Series2023-11-21icsa · cisa_csaf_otUS
Successful exploitation of this vulnerability could allow an attacker with administrative privileges can access sensitive files in an unintended, undocumented way.

also known as (5)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cisa_csaf_ot wago_psirt NVD CVE.org MITRE

published 2023-10-17modified 2026-06-17

references (5)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan