CVE-2024-1490

An authenticated remote attacker with high privileges can exploit the OpenVPN configuration via the web-based management interface of a WAGO PLC. If user-defined scripts are permitted, OpenVPN may allow the execution of arbitrary shell commands enabling the attacker to run arbitrary commands on the device.

Score

CVSS 3.1 7.2 High

Status

Awaiting Analysis - info@cert.vde.com

Published

2026-04-09

Last modified

2026-04-09

Weaknesses

CWE-94

Affected products

• Cc100 0751-9x01 (Wago)
• Edge Controller 0752-8303-8000-0002 (Wago)
• Pfc100 G1 0750-810-xxxx-xxxx (Wago)
• Pfc100 G2 0750-811x-xxxx-xxxx (Wago)
• Pfc200 G1 750-820x-xxxx-xxxx (Wago)
• Pfc200 G2 750-821x-xxxx-xxxx (Wago)
• Tp600 0762-420x-8000-000x (Wago)
• Tp600 0762-430x-8000-000x (Wago)
• Tp600 0762-520x-8000-000x (Wago)
• Tp600 0762-530x-8000-000x (Wago)
• Tp600 0762-620x-8000-000x (Wago)
• Tp600 0762-630x-8000-000x (Wago)
• Wp400 0762-340x (Wago)

References

• https://certvde.com/de/advisories/VDE-2024-008
• https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2024-008.json