Read the docs
TI-2025-18921 Aliases CVE-2025-25265GHSA-62rm-vcwg-chv2

Unauthenticated File Read via Web Interface

Priority MEDIUM 56CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

A web application for configuring the controller is accessible at a specific path. It contains an endpoint that allows a high privileged remote attacker to read files from the system’s file structure.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00456 39th percentileScored 2026-11-07
Fix Fixed WAGO CC100 0751-9x01 (WAGO): 04.07.01 (FW29)CC100 0751-9x01 (WAGO): 04.07.01 (70)+11 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WAGOWAGO CC100 0751-9x010.0.0 to before 04.07.01 (FW29)04.07.01 (FW29)Patch availableCNA
WAGOCC100 0751-9x010.0.0 to before 04.07.01 (70)04.07.01 (70)Patch availableCNA
WAGOPFC100 G1 0750-810x/xxxx-xxxx0.0.0 to before 3.10.11 (FW22 Patch 2)3.10.11 (FW22 Patch 2)Patch availableCNA
WAGOPFC100 G2 0750-811x-xxxx-xxxx0.0.0 to before 04.07.01 (FW29)04.07.01 (FW29)Patch availableCNA
WAGOPFC100 G2 0750-811x-xxxx-xxxx0.0.0 to before 04.07.01 (70)04.07.01 (70)Patch availableCNA
WAGOPFC200 G1 750-820x-xxx-xxx0.0.0 to before 3.10.11 (FW22 Patch 2)3.10.11 (FW22 Patch 2)Patch availableCNA
WAGOPFC200 G2 750-821x-xxx-xxx0.0.0 to before 04.07.01 (FW29)04.07.01 (FW29)Patch availableCNA
WAGOPFC200 G2 750-821x-xxx-xxx0.0.0 to before 04.07.01 (70)04.07.01 (70)Patch availableCNA
WAGOTP600 0762-420x/8000-000x0.0.0 to before 04.07.01 (FW29)04.07.01 (FW29)Patch availableCNA
WAGOTP600 0762-420x/8000-000x0.0.0 to before 04.07.01 (70)04.07.01 (70)Patch availableCNA
WAGOTP600 0762-430x/8000-000x0.0.0 to before 04.07.01 (FW29)04.07.01 (FW29)Patch availableCNA
WAGOTP600 0762-430x/8000-000x0.0.0 to before 04.07.01 (70)04.07.01 (70)Patch availableCNA
WAGOTP600 0762-520x/8000-000x0.0.0 to before 04.07.01 (FW29)04.07.01 (FW29)Patch availableCNA
WAGOTP600 0762-520x/8000-000x0.0.0 to before 04.07.01 (70)04.07.01 (70)Patch availableCNA
WAGOTP600 0762-530x/8000-000x0.0.0 to before 04.07.01 (FW29)04.07.01 (FW29)Patch availableCNA
WAGOTP600 0762-530x/8000-000x0.0.0 to before 04.07.01 (70)04.07.01 (70)Patch availableCNA
WAGOTP600 0762-620x/8000-000x0.0.0 to before 04.07.01 (FW29)04.07.01 (FW29)Patch availableCNA
WAGOTP600 0762-620x/8000-000x0.0.0 to before 04.07.01 (70)04.07.01 (70)Patch availableCNA
WAGOTP600 0762-630x/8000-000x0.0.0 to before 04.07.01 (FW29)04.07.01 (FW29)Patch availableCNA
WAGOTP600 0762-630x/8000-000x0.0.0 to before 04.07.01 (70)04.07.01 (70)Patch availableCNA
WAGOEdge Controller 0752-8303/8000-00020.0.0 to before 04.07.01 (FW29)04.07.01 (FW29)Patch availableCNA
WAGOEdge Controller 0752-8303/8000-00020.0.0 to before 04.07.01 (70)04.07.01 (70)Patch availableCNA
  • WAGO CC100 0751-9x01 VendorWAGO Affected 0.0.0 to before 04.07.01 (FW29) Fixed in 04.07.01 (FW29) Patch available CNA
  • CC100 0751-9x01 VendorWAGO Affected 0.0.0 to before 04.07.01 (70) Fixed in 04.07.01 (70) Patch available CNA
  • PFC100 G1 0750-810x/xxxx-xxxx VendorWAGO Affected 0.0.0 to before 3.10.11 (FW22 Patch 2) Fixed in 3.10.11 (FW22 Patch 2) Patch available CNA
  • PFC100 G2 0750-811x-xxxx-xxxx VendorWAGO Affected 0.0.0 to before 04.07.01 (FW29) Fixed in 04.07.01 (FW29) Patch available CNA
  • PFC100 G2 0750-811x-xxxx-xxxx VendorWAGO Affected 0.0.0 to before 04.07.01 (70) Fixed in 04.07.01 (70) Patch available CNA
  • PFC200 G1 750-820x-xxx-xxx VendorWAGO Affected 0.0.0 to before 3.10.11 (FW22 Patch 2) Fixed in 3.10.11 (FW22 Patch 2) Patch available CNA
  • PFC200 G2 750-821x-xxx-xxx VendorWAGO Affected 0.0.0 to before 04.07.01 (FW29) Fixed in 04.07.01 (FW29) Patch available CNA
  • PFC200 G2 750-821x-xxx-xxx VendorWAGO Affected 0.0.0 to before 04.07.01 (70) Fixed in 04.07.01 (70) Patch available CNA
  • TP600 0762-420x/8000-000x VendorWAGO Affected 0.0.0 to before 04.07.01 (FW29) Fixed in 04.07.01 (FW29) Patch available CNA
  • TP600 0762-420x/8000-000x VendorWAGO Affected 0.0.0 to before 04.07.01 (70) Fixed in 04.07.01 (70) Patch available CNA
  • TP600 0762-430x/8000-000x VendorWAGO Affected 0.0.0 to before 04.07.01 (FW29) Fixed in 04.07.01 (FW29) Patch available CNA
  • TP600 0762-430x/8000-000x VendorWAGO Affected 0.0.0 to before 04.07.01 (70) Fixed in 04.07.01 (70) Patch available CNA
  • TP600 0762-520x/8000-000x VendorWAGO Affected 0.0.0 to before 04.07.01 (FW29) Fixed in 04.07.01 (FW29) Patch available CNA
  • TP600 0762-520x/8000-000x VendorWAGO Affected 0.0.0 to before 04.07.01 (70) Fixed in 04.07.01 (70) Patch available CNA
  • TP600 0762-530x/8000-000x VendorWAGO Affected 0.0.0 to before 04.07.01 (FW29) Fixed in 04.07.01 (FW29) Patch available CNA
  • TP600 0762-530x/8000-000x VendorWAGO Affected 0.0.0 to before 04.07.01 (70) Fixed in 04.07.01 (70) Patch available CNA
  • TP600 0762-620x/8000-000x VendorWAGO Affected 0.0.0 to before 04.07.01 (FW29) Fixed in 04.07.01 (FW29) Patch available CNA
  • TP600 0762-620x/8000-000x VendorWAGO Affected 0.0.0 to before 04.07.01 (70) Fixed in 04.07.01 (70) Patch available CNA
  • TP600 0762-630x/8000-000x VendorWAGO Affected 0.0.0 to before 04.07.01 (FW29) Fixed in 04.07.01 (FW29) Patch available CNA
  • TP600 0762-630x/8000-000x VendorWAGO Affected 0.0.0 to before 04.07.01 (70) Fixed in 04.07.01 (70) Patch available CNA
  • Edge Controller 0752-8303/8000-0002 VendorWAGO Affected 0.0.0 to before 04.07.01 (FW29) Fixed in 04.07.01 (FW29) Patch available CNA
  • Edge Controller 0752-8303/8000-0002 VendorWAGO Affected 0.0.0 to before 04.07.01 (70) Fixed in 04.07.01 (70) Patch available CNA

Remediation

  • Fix · CNA WAGO CC100 0751-9x01 (WAGO) Fixed in 04.07.01 (FW29)
  • Fix · CNA CC100 0751-9x01 (WAGO) Fixed in 04.07.01 (70)
  • Fix · CNA PFC100 G1 0750-810x/xxxx-xxxx (WAGO) Fixed in 3.10.11 (FW22 Patch 2)
  • Fix · CNA PFC100 G2 0750-811x-xxxx-xxxx (WAGO) Fixed in 04.07.01 (FW29)
  • Fix · CNA PFC100 G2 0750-811x-xxxx-xxxx (WAGO) Fixed in 04.07.01 (70)
  • Fix · CNA PFC200 G1 750-820x-xxx-xxx (WAGO) Fixed in 3.10.11 (FW22 Patch 2)
  • Fix · CNA PFC200 G2 750-821x-xxx-xxx (WAGO) Fixed in 04.07.01 (FW29)
  • Fix · CNA PFC200 G2 750-821x-xxx-xxx (WAGO) Fixed in 04.07.01 (70)
  • Fix · CNA TP600 0762-420x/8000-000x (WAGO) Fixed in 04.07.01 (FW29)
  • Fix · CNA TP600 0762-420x/8000-000x (WAGO) Fixed in 04.07.01 (70)
  • Fix · CNA TP600 0762-430x/8000-000x (WAGO) Fixed in 04.07.01 (FW29)
  • Fix · CNA TP600 0762-430x/8000-000x (WAGO) Fixed in 04.07.01 (70)
  • Fix · CNA TP600 0762-520x/8000-000x (WAGO) Fixed in 04.07.01 (FW29)
  • Fix · CNA TP600 0762-520x/8000-000x (WAGO) Fixed in 04.07.01 (70)
  • Fix · CNA TP600 0762-530x/8000-000x (WAGO) Fixed in 04.07.01 (FW29)
  • Fix · CNA TP600 0762-530x/8000-000x (WAGO) Fixed in 04.07.01 (70)
  • Fix · CNA TP600 0762-620x/8000-000x (WAGO) Fixed in 04.07.01 (FW29)
  • Fix · CNA TP600 0762-620x/8000-000x (WAGO) Fixed in 04.07.01 (70)
  • Fix · CNA TP600 0762-630x/8000-000x (WAGO) Fixed in 04.07.01 (FW29)
  • Fix · CNA TP600 0762-630x/8000-000x (WAGO) Fixed in 04.07.01 (70)
  • Fix · CNA Edge Controller 0752-8303/8000-0002 (WAGO) Fixed in 04.07.01 (FW29)
  • Fix · CNA Edge Controller 0752-8303/8000-0002 (WAGO) Fixed in 04.07.01 (70)

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    WAGO Edge Controller 0752-8303/8000-0002, PFC100 G1 0750-810x/xxxx-xxxx and 9 more products 04.07.01 (70), 04.07.01 (FW29), 3.10.11 (FW22 Patch 2)

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2025-18920 Overly Permissive CORS Policy in WAGO Device ManagerPriority LOW 31
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-25265
  2. 2026-10-03 Alias added: GHSA-62rm-vcwg-chv2

References

Other 1

  • TI-2023-01594 WAGO: WBM Command Injection in multiple products CVSS 3.1CRITICAL 9.8
  • TI-2020-06893 eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eap_request and eap_response functions. CVSS 3.1CRITICAL 9.8
  • TI-2018-09314 An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware… CVSS 3.1HIGH 8.8
  • TI-2026-18391 Stack Overflow via Oversized Cookie Fields in lighttpd CVSS 3.1CRITICAL 9.8
  • TI-2026-18390 Stack Overflow via SESSIONID Cookie in lighttpd CVSS 3.1CRITICAL 9.8
  • TI-2026-03092 Hidden CLI Function Allows Root Access CVSS 3.1CRITICAL 10.0
See all 145 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences