What’s Vulnerable › Vulnerabilities

CVE-2024-1490: Wago: Vulnerability in WBM through Open VPN

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-09 · updated 2026-06-17
• Weakness: CWE-94

Description

An authenticated remote attacker with high privileges can exploit the OpenVPN configuration via the web-based management interface of a WAGO PLC. If user-defined scripts are permitted, OpenVPN may allow the execution of arbitrary shell commands enabling the attacker to run arbitrary commands on the device.

Affected products

• WAGO CC100 0751-9x01: through 4.5.10
• WAGO Edge Controller (0752-8303-8000-0002): through 4.5.10
• WAGO PFC100 G1 (0750-810-xxxx-xxxx): through 3.10.10
• WAGO PFC100 G2 0750-811x-xxxx-xxxx: through 4.5.10
• WAGO PFC200 G1 (750-820x-xxxx-xxxx): through 3.10.10
• WAGO PFC200 G2 (750-821x-xxxx-xxxx): through 4.5.10
• WAGO TP600 (0762-420x-8000-000x): through FW 26
• WAGO TP600 (0762-430x-8000-000x): through 4.5.10
• WAGO TP600 (0762-520x-8000-000x): through 4.5.10
• WAGO TP600 (0762-530x-8000-000x): through 4.5.10
• WAGO TP600 (0762-620x-8000-000x): 0.0.0
• WAGO TP600 (0762-630x-8000-000x): through 4.5.10
• WAGO WP400 (0762-340x): through 4.5.10

References

• https://certvde.com/de/advisories/VDE-2024-008
• https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2024-008.json

Get alerted when CVE-2024-1490 or the next vulnerability affects your stack