Vulnerability · Published Jul 13, 2026 · Assigned by CERTVDE
CVE-2026-4769Unauthenticated Access to Internal Diagnostic Interface
Critical 9.8
In plain English
A critical-severity security flaw in 0765-110x/0100-0000 from WAGO. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 55% of all known vulnerabilities).
Official description
Certain devices in the WAGO System I/O Field series activate an internal diagnostic capability during the initial startup sequence. This functionality is not formally documented and becomes accessible without authentication for a brief period in the early boot phase. During this window, an unauthenticated remote attacker can gain access to the internal system processes, resulting in full system compromise.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| WAGO | 0765-110x/0100-0000 | 1.0.0.0 – before 1.2.1.100 |
| WAGO | 0765-120x/0100-0000 | 1.0.0.0 – before 1.2.7.100 |
| WAGO | 0765-150x/0100-0000 | 1.0.0.0 – before 1.2.7.103 |
| WAGO | 0765-2101/0100-0000 | 1.0.0.0 – before 1.2.1.102 |
| WAGO | 0765-2102/0100-0000 | 1.0.0.0 – before 1.2.5.101 |
| WAGO | 0765-410x/0100-0000 | 1.0.0.0 – before 1.2.1.100 |
| WAGO | 0765-420x/0100-0000 | 1.0.0.0 – before 1.2.7.100 |
| WAGO | 0765-450x/0100-0000 | 1.0.0.0 – before 1.2.7.103 |
Weakness: CWE-912 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H