Wago Cc100 0751 9X01 vulnerabilities
13 vulnerabilities
Known vulnerabilities in Wago Cc100 0751 9X01, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2025-0101wagocc100 0751-9x01+12
EPSS score0.39%
A low privileged user can set the date of the devices to the 19th of January 2038 an therefore exceed the 32-Bit time limit. This causes some functions to work unexpected or stop working at all. Both during runtime and after a restart.CVE-2025-25264wagocc100 0751-9x01+11EPSS score0.44%
An unauthenticated remote attacker can trick an admin to visit a website containing malicious java script code. The current overly permissive CORS policy allows the attacker to obtain any files from the file system.CVE-2025-25265wagocc100 0751-9x01+12EPSS score0.46%
A web application for configuring the controller is accessible at a specific path. It contains an endpoint that allows a high privileged remote attacker to read files from the system’s file structure.CVE-2024-1490wagocc100 0751-9x01+12EPSS score0.73%
An authenticated remote attacker with high privileges can exploit the OpenVPN configuration via the web-based management interface of a WAGO PLC. If user-defined scripts are permitted, OpenVPN may allow the execution of arbitrary shell commands enabling the attacker to run arbitrary commands on the device.CVE-2024-41967wagocc100 0751-9x01+14EPSS score0.41%
A low privileged remote attacker may modify the boot mode configuration setup of the device, leading to modification of the firmware upgrade process or a denial-of-service attack.CVE-2024-41972wagocc100 0751-9x01+11EPSS score0.59%
A low privileged remote attacker can overwrite an arbitrary file on the filesystem which may lead to an arbitrary file read with root privileges.CVE-2024-41971wagocc100 0751-9x01+11EPSS score0.63%
A low privileged remote attacker can overwrite an arbitrary file on the filesystem leading to a DoS and data loss.CVE-2024-41968wagocc100 0751-9x01+14EPSS score0.34%
A low privileged remote attacker may modify the docker settings setup of the device, leading to a limited DoS.CVE-2024-41969wagocc100 0751-9x01+14EPSS score0.50%
A low privileged remote attacker may modify the configuration of the CODESYS V3 service through a missing authentication vulnerability which could lead to full system access and/or DoS.CVE-2024-41970wagocc100 0751-9x01+11EPSS score0.34%
A low privileged remote attacker may gain access to forbidden diagnostic data due to incorrect permission assignment for critical resources.CVE-2024-41974wagocc100 0751-9x01+11EPSS score0.36%
A low privileged remote attacker may modify the BACNet service properties due to incorrect permission assignment for critical resources which may lead to a DoS limited to BACNet communication.CVE-2024-41973wagocc100 0751-9x01+11EPSS score0.63%
A low privileged remote attacker can specify an arbitrary file on the filesystem which may lead to an arbitrary file writes with root privileges.CVE-2024-12650wagocc100 0751-9x01+11EPSS score0.29%
An attacker with low privileges can manipulate the requested memory size, causing the application to use an invalid memory area. This could lead to a crash of the application but it does not affected other applications.