Read the docs
TI-2025-27629 Aliases CVE-2025-41664GHSA-fr5v-wr5v-rf59

Improper Permission Handling Enables Unauthorized Access to Firmware and Certificates

Priority LOW 34CWE-732Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

A low-privileged remote attacker could gain unauthorized access to critical resources, such as firmware and certificates, due to improper permission handling during the runtime of services (e.g., FTP/SFTP). This access could allow the attacker to escalate privileges and modify firmware.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00247 16th percentileScored 2026-11-07
Fix Fixed Coupler 0750-0362 (WAGO): FW13Coupler 0750-0362/0000-0001 (WAGO): FW13+8 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WAGOCoupler 0750-0362before FW13FW13Patch availableCNA
WAGOCoupler 0750-0362/0000-0001before FW13FW13Patch availableCNA
WAGOCoupler 0750-0362/0040-0000before FW13FW13Patch availableCNA
WAGOCoupler 0750-0362/K013-1080before FW13FW13Patch availableCNA
WAGOCoupler 0750-0362/K019-7576before FW13FW13Patch availableCNA
WAGOCoupler 0750-0363before FW13FW13Patch availableCNA
WAGOCoupler 0750-0363/0040-0000before FW13FW13Patch availableCNA
WAGOCoupler 0750-0364/0040-0010before FW13FW13Patch availableCNA
WAGOCoupler 0750-0365/0040-0010before FW13FW13Patch availableCNA
WAGOCoupler 0750-0366before FW13FW13Patch availableCNA
  • Coupler 0750-0362 VendorWAGO Affected before FW13 Fixed in FW13 Patch available CNA
  • Coupler 0750-0362/0000-0001 VendorWAGO Affected before FW13 Fixed in FW13 Patch available CNA
  • Coupler 0750-0362/0040-0000 VendorWAGO Affected before FW13 Fixed in FW13 Patch available CNA
  • Coupler 0750-0362/K013-1080 VendorWAGO Affected before FW13 Fixed in FW13 Patch available CNA
  • Coupler 0750-0362/K019-7576 VendorWAGO Affected before FW13 Fixed in FW13 Patch available CNA
  • Coupler 0750-0363 VendorWAGO Affected before FW13 Fixed in FW13 Patch available CNA
  • Coupler 0750-0363/0040-0000 VendorWAGO Affected before FW13 Fixed in FW13 Patch available CNA
  • Coupler 0750-0364/0040-0010 VendorWAGO Affected before FW13 Fixed in FW13 Patch available CNA
  • Coupler 0750-0365/0040-0010 VendorWAGO Affected before FW13 Fixed in FW13 Patch available CNA
  • Coupler 0750-0366 VendorWAGO Affected before FW13 Fixed in FW13 Patch available CNA

Remediation

  • Fix · CNA Coupler 0750-0362 (WAGO) Fixed in FW13
  • Fix · CNA Coupler 0750-0362/0000-0001 (WAGO) Fixed in FW13
  • Fix · CNA Coupler 0750-0362/0040-0000 (WAGO) Fixed in FW13
  • Fix · CNA Coupler 0750-0362/K013-1080 (WAGO) Fixed in FW13
  • Fix · CNA Coupler 0750-0362/K019-7576 (WAGO) Fixed in FW13
  • Fix · CNA Coupler 0750-0363 (WAGO) Fixed in FW13
  • Fix · CNA Coupler 0750-0363/0040-0000 (WAGO) Fixed in FW13
  • Fix · CNA Coupler 0750-0364/0040-0010 (WAGO) Fixed in FW13
  • Fix · CNA Coupler 0750-0365/0040-0010 (WAGO) Fixed in FW13
  • Fix · CNA Coupler 0750-0366 (WAGO) Fixed in FW13

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-41664
  2. 2026-10-03 Alias added: GHSA-fr5v-wr5v-rf59

References

Other 1

  • TI-2023-01594 WAGO: WBM Command Injection in multiple products CVSS 3.1CRITICAL 9.8
  • TI-2020-06893 eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eap_request and eap_response functions. CVSS 3.1CRITICAL 9.8
  • TI-2018-09314 An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware… CVSS 3.1HIGH 8.8
  • TI-2025-18921 Unauthenticated File Read via Web Interface CVSS 3.1MEDIUM 4.9
  • TI-2026-18391 Stack Overflow via Oversized Cookie Fields in lighttpd CVSS 3.1CRITICAL 9.8
  • TI-2026-18390 Stack Overflow via SESSIONID Cookie in lighttpd CVSS 3.1CRITICAL 9.8
See all 145 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences