CVE-2025-41753: Path traversal in dynamically created BACnet File Objects

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-01 · updated 2026-10-14
Weakness: CWE-22

Description

The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation. Because relative paths are not limited to the intended directory, an unauthenticated remote attacker can traverse outside of it and read or overwrite arbitrary files on the device, which may lead to full system compromise.

Affected products

WAGO 0750-811x-xxxx-xxxx: from 1.0.0 before 4.8.9; from 1.0.0 before 4.8.9 (70) — fixed in 4.8.9, 4.8.9 (70)
WAGO 0750-821x-xxx-xxx: from 1.0.0 before 4.8.9; from 1.0.0 before 4.8.9 (70) — fixed in 4.8.9, 4.8.9 (70)
WAGO 0751-9x01: from 1.0.0 before 4.8.9; from 1.0.0 before 4.8.9 (70) — fixed in 4.8.9, 4.8.9 (70)
WAGO 0752-8303-8000-0002: from 1.0.0 before 4.8.9; from 1.0.0 before 4.8.9 (70) — fixed in 4.8.9, 4.8.9 (70)
WAGO 0762-340x: from 1.0.0 before 4.8.9; from 1.0.0 before 4.8.9 (70) — fixed in 4.8.9, 4.8.9 (70)
WAGO 0762-420x-8000-000x: from 1.0.0 before 4.8.9; from 1.0.0 before 4.8.9 (70) — fixed in 4.8.9, 4.8.9 (70)
WAGO 0762-430x-8000-000x: from 1.0.0 before 4.8.9; from 1.0.0 before 4.8.9 (70) — fixed in 4.8.9, 4.8.9 (70)
WAGO 0762-520x-8000-000x: from 1.0.0 before 4.8.9; from 1.0.0 before 4.8.9 (70) — fixed in 4.8.9, 4.8.9 (70)
WAGO 0762-530x-8000-000x: from 1.0.0 before 4.8.9; from 1.0.0 before 4.8.9 (70) — fixed in 4.8.9, 4.8.9 (70)
WAGO 0762-620x-8000-000x: from 1.0.0 before 4.8.9; from 1.0.0 before 4.8.9 (70) — fixed in 4.8.9, 4.8.9 (70)
WAGO 0762-630x-8000-000x: from 1.0.0 before 4.8.9; from 1.0.0 before 4.8.9 (70) — fixed in 4.8.9, 4.8.9 (70)

How to fix

Upgrade to a fixed version: WAGO 0750-811x-xxxx-xxxx 4.8.9, 4.8.9 (70); WAGO 0750-821x-xxx-xxx 4.8.9, 4.8.9 (70); WAGO 0751-9x01 4.8.9, 4.8.9 (70); WAGO 0752-8303-8000-0002 4.8.9, 4.8.9 (70); WAGO 0762-340x 4.8.9, 4.8.9 (70); WAGO 0762-420x-8000-000x 4.8.9, 4.8.9 (70); WAGO 0762-430x-8000-000x 4.8.9, 4.8.9 (70); WAGO 0762-520x-8000-000x 4.8.9, 4.8.9 (70); WAGO 0762-530x-8000-000x 4.8.9, 4.8.9 (70); WAGO 0762-620x-8000-000x 4.8.9, 4.8.9 (70); WAGO 0762-630x-8000-000x 4.8.9, 4.8.9 (70). Check the vendor advisory for mitigations.

References

https://www.certvde.com/en/advisories/VDE-2025-102/

Get alerted when CVE-2025-41753 or the next vulnerability affects your stack