What’s Vulnerable › Vulnerabilities

CVE-2020-12522: Command Injection Vulnerability in I/O-Check Service of WAGO PFC100, PFC200 and Touch Panel 600 Series with firmware versions <=FW10

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-12-17 · updated 2026-06-17
• Weakness: CWE-78

Description

The reported vulnerability allows an attacker who has network access to the device to execute code with specially crafted packets in WAGO Series PFC 100 (750-81xx/xxx-xxx), Series PFC 200 (750-82xx/xxx-xxx), Series Wago Touch Panel 600 Standard Line (762-4xxx), Series Wago Touch Panel 600 Advanced Line (762-5xxx), Series Wago Touch Panel 600 Marine Line (762-6xxx) with firmware versions <=FW10.

Affected products

• WAGO Pfc 100 Firmware: through 10
• WAGO Pfc 200 Firmware: through 10
• WAGO Touch Panel 600 Advanced Firmware: through 10
• WAGO Touch Panel 600 Marine Firmware: through 10
• WAGO Touch Panel 600 Standard Firmware: through 10

References

• https://cert.vde.com/en-us/advisories/vde-2020-045
• https://cert.vde.com/en-us/advisories/vde-2020-045

Get alerted when CVE-2020-12522 or the next vulnerability affects your stack