Read the docs
TI-2021-13596 Aliases CVE-2021-34578GHSA-m68m-r5xj-h4vj

WAGO: Authentication Vulnerability in Web-Based Management

Priority MEDIUM 44CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-287.

Summary

This vulnerability allows an attacker who has access to the WBM to read and write settings-parameters of the device by sending specifically constructed requests without authentication on multiple WAGO PLCs in firmware versions up to FW07.

Why it matters now

EPSS 0.00963 61st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
WAGOPLC750-362 – FW07; 750-363 – FW07; 750-823 – FW07; 750-832/xxx-xxx – FW07; 750-862 – FW07; 750-891 – FW07; 750-890/xxx-xxx – FW07; 750-893 – FW07—No fix listedCNA
  • PLC VendorWAGO Affected 750-362 – FW07; 750-363 – FW07; 750-823 – FW07; 750-832/xxx-xxx – FW07; 750-862 – FW07; 750-891 – FW07; 750-890/xxx-xxx – FW07; 750-893 – FW07 Fixed in — No fix listed CNA

CPE configurations NVD · 24

CPEVersionsRoleVendor
cpe:2.3:o:wago:750-890\/040-000_firmware:*:*:*:*:*:*:*:*up to fw07VulnerableWAGO
cpe:2.3:h:wago:750-890\/040-000:-:*:*:*:*:*:*:*not specified by NVDRunning onWAGO
cpe:2.3:o:wago:750-890\/025-001_firmware:*:*:*:*:*:*:*:*up to fw07VulnerableWAGO
cpe:2.3:h:wago:750-890\/025-001:-:*:*:*:*:*:*:*not specified by NVDRunning onWAGO
cpe:2.3:o:wago:750-890\/025-002_firmware:*:*:*:*:*:*:*:*up to fw07VulnerableWAGO
cpe:2.3:h:wago:750-890\/025-002:-:*:*:*:*:*:*:*not specified by NVDRunning onWAGO
cpe:2.3:o:wago:750-890\/025-000_firmware:*:*:*:*:*:*:*:*up to fw07VulnerableWAGO
cpe:2.3:h:wago:750-890\/025-000:-:*:*:*:*:*:*:*not specified by NVDRunning onWAGO
cpe:2.3:o:wago:750-832\/000-002_firmware:*:*:*:*:*:*:*:*up to fw07VulnerableWAGO
cpe:2.3:h:wago:750-832\/000-002:-:*:*:*:*:*:*:*not specified by NVDRunning onWAGO
  • cpe:2.3:o:wago:750-890\/040-000_firmware:*:*:*:*:*:*:*:* Versions up to fw07 Vulnerable ·WAGO
  • cpe:2.3:h:wago:750-890\/040-000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
  • cpe:2.3:o:wago:750-890\/025-001_firmware:*:*:*:*:*:*:*:* Versions up to fw07 Vulnerable ·WAGO
  • cpe:2.3:h:wago:750-890\/025-001:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
  • cpe:2.3:o:wago:750-890\/025-002_firmware:*:*:*:*:*:*:*:* Versions up to fw07 Vulnerable ·WAGO
  • cpe:2.3:h:wago:750-890\/025-002:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
  • cpe:2.3:o:wago:750-890\/025-000_firmware:*:*:*:*:*:*:*:* Versions up to fw07 Vulnerable ·WAGO
  • cpe:2.3:h:wago:750-890\/025-000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
  • cpe:2.3:o:wago:750-832\/000-002_firmware:*:*:*:*:*:*:*:* Versions up to fw07 Vulnerable ·WAGO
  • cpe:2.3:h:wago:750-832\/000-002:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
Show 14 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:wago:750-362_firmware:*:*:*:*:*:*:*:*up to fw07VulnerableWAGO
cpe:2.3:h:wago:750-362:-:*:*:*:*:*:*:*not specified by NVDRunning onWAGO
cpe:2.3:o:wago:750-823_firmware:*:*:*:*:*:*:*:*up to fw07VulnerableWAGO
cpe:2.3:h:wago:750-823:-:*:*:*:*:*:*:*not specified by NVDRunning onWAGO
cpe:2.3:o:wago:750-832_firmware:*:*:*:*:*:*:*:*up to fw07VulnerableWAGO
cpe:2.3:h:wago:750-832:-:*:*:*:*:*:*:*not specified by NVDRunning onWAGO
cpe:2.3:o:wago:750-363_firmware:*:*:*:*:*:*:*:*up to fw07VulnerableWAGO
cpe:2.3:h:wago:750-363:-:*:*:*:*:*:*:*not specified by NVDRunning onWAGO
cpe:2.3:o:wago:750-862_firmware:*:*:*:*:*:*:*:*up to fw07VulnerableWAGO
cpe:2.3:h:wago:750-862:-:*:*:*:*:*:*:*not specified by NVDRunning onWAGO
cpe:2.3:o:wago:750-891_firmware:*:*:*:*:*:*:*:*up to fw07VulnerableWAGO
cpe:2.3:h:wago:750-891:-:*:*:*:*:*:*:*not specified by NVDRunning onWAGO
cpe:2.3:o:wago:750-893_firmware:*:*:*:*:*:*:*:*up to fw07VulnerableWAGO
cpe:2.3:h:wago:750-893:-:*:*:*:*:*:*:*not specified by NVDRunning onWAGO
  • cpe:2.3:o:wago:750-362_firmware:*:*:*:*:*:*:*:* Versions up to fw07 Vulnerable ·WAGO
  • cpe:2.3:h:wago:750-362:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
  • cpe:2.3:o:wago:750-823_firmware:*:*:*:*:*:*:*:* Versions up to fw07 Vulnerable ·WAGO
  • cpe:2.3:h:wago:750-823:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
  • cpe:2.3:o:wago:750-832_firmware:*:*:*:*:*:*:*:* Versions up to fw07 Vulnerable ·WAGO
  • cpe:2.3:h:wago:750-832:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
  • cpe:2.3:o:wago:750-363_firmware:*:*:*:*:*:*:*:* Versions up to fw07 Vulnerable ·WAGO
  • cpe:2.3:h:wago:750-363:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
  • cpe:2.3:o:wago:750-862_firmware:*:*:*:*:*:*:*:* Versions up to fw07 Vulnerable ·WAGO
  • cpe:2.3:h:wago:750-862:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
  • cpe:2.3:o:wago:750-891_firmware:*:*:*:*:*:*:*:* Versions up to fw07 Vulnerable ·WAGO
  • cpe:2.3:h:wago:750-891:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
  • cpe:2.3:o:wago:750-893_firmware:*:*:*:*:*:*:*:* Versions up to fw07 Vulnerable ·WAGO
  • cpe:2.3:h:wago:750-893:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-34578
  2. 2026-10-03 Alias added: GHSA-m68m-r5xj-h4vj

References

Advisory 1

  • TI-2020-10001 WAGO: Authentication Bypass Vulnerability in WAGO 750-36X and WAGO 750-8XX Versions <= FW03 CVSS 3.1CRITICAL 9.1
  • TI-2023-01088 WAGO: Series 750-3x/-8x prone to MODBUS server DoS CVSS 3.1HIGH 7.5
  • TI-2018-11605 WAGO 750-88X and WAGO 750-89X Ethernet Controller devices, versions 01.09.18(13) and… CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences