What’s Vulnerable › Vulnerabilities
CVE-2018-25090: Wago: Improper Neutralization of Input During Web Page Generation in multiple devices
- Severity: medium (CVSS 5.4 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-03-13 · updated 2026-06-17
- Weakness: CWE-79
Description
An unauthenticated remote attacker can use an XSS attack due to improper neutralization of input during web page generation. User interaction is required. This leads to a limited impact of confidentiality and integrity but no impact of availability.
Affected products
- WAGO Controller BACnet MS/TP: through FW13
- WAGO Controller BACnet/IP: through FW13
- WAGO Ethernet Controller 3rd Generation: through FW13
- WAGO Fieldbus Coupler Ethernet 3rd Generation: through FW13
References
Get alerted when CVE-2018-25090 or the next vulnerability affects your stack