WAGO: Multiple products vulnerable to local file inclusion

Description

On affected Wago products an remote attacker with administrative privileges can access files to which he has already access to through an undocumented local file inclusion. This access is logged in a different log file than expected.

Scores

EPSS (exploitation in 30 days)

0.63% · top 50% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 2.7.

Weakness

• CWE-610 Externally Controlled Reference to a Resource in Another Sphere (opens in a new tab)All about CWE-610 and its CVEs

Affected products

• WAGO · Compact Controller CC100

  • affected FW19 – ≤ FW26

• WAGO · Edge Controller

  • affected FW18 – ≤ FW26

• WAGO · PFC100

  • affected FW16 – ≤ FW26

• WAGO · PFC200

  • affected FW16 – ≤ FW26

• WAGO · Touch Panel 600 Advanced Line

  • affected FW16 – ≤ FW26

• WAGO · Touch Panel 600 Marine Line

  • affected FW16 – ≤ FW26

• WAGO · Touch Panel 600 Standard Line

  • affected FW16 – ≤ FW26

References (1)

• https://cert.vde.com/en/advisories/VDE-2023-046/ (opens in a new tab)x_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2023-4089](https://trackcve.app/badge/CVE-2023-4089.svg)](https://trackcve.app/cve/CVE-2023-4089)

Record last updated 27 Feb 2025, 20:40 UTC.