Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2025-25264

Overly Permissive CORS Policy in WAGO Device Manager

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
CERTVDE

Description

An unauthenticated remote attacker can trick an admin to visit a website containing malicious java script code. The current overly permissive CORS policy allows the attacker to obtain any files from the file system.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WAGO CC100 0751-9x01

Default version status: unaffected

  • 0.0.0 to < 04.07.01 (FW29)affected

WAGO CC100 0751-9x01

Default version status: unaffected

  • 0.0.0 to < 04.07.01 (70affected

WAGO PFC100 G1 0750-810x/xxxx-xxxx

Default version status: unaffected

  • 0.0.0 to < 3.10.11 (FW22 Patch 2)affected

WAGO PFC100 G2 0750-811x-xxxx-xxxx

Default version status: unaffected

  • 0.0.0 to < 04.07.01 (70)affected

WAGO PFC200 G1 750-820x-xxx-xxx

Default version status: unaffected

  • 0.0.0 to < 3.10.11 (FW22 Patch 2)affected

WAGO PFC200 G2 750-821x-xxx-xxx

Default version status: unaffected

  • 0.0.0 to < 04.07.01 (FW29)affected

WAGO PFC200 G2 750-821x-xxx-xxx

Default version status: unaffected

  • 0.0.0 to < 04.07.01 (70)affected

WAGO TP600 0762-420x/8000-000x

Default version status: unaffected

  • 0.0.0 to < 04.07.01 (FW29)affected

WAGO TP600 0762-420x/8000-000x

Default version status: unaffected

  • 0.0.0 to < 04.07.01 (70)affected

WAGO TP600 0762-430x/8000-000x

Default version status: unaffected

  • 0.0.0 to < 04.07.01 (FW29)affected

WAGO TP600 0762-430x/8000-000x

Default version status: unaffected

  • 0.0.0 to < 04.07.01 (70)affected

WAGO TP600 0762-520x/8000-000x

Default version status: unaffected

  • 0.0.0 to < 04.07.01 (FW29)affected

WAGO TP600 0762-520x/8000-000x

Default version status: unaffected

  • 0.0.0 to < 04.07.01 (70)affected

WAGO TP600 0762-530x/8000-000x

Default version status: unaffected

  • 0.0.0 to < 04.07.01 (FW29)affected

WAGO TP600 0762-530x/8000-000x

Default version status: unaffected

  • 0.0.0 to < 04.07.01 (70)affected

WAGO TP600 0762-620x/8000-000x

Default version status: unaffected

  • 0.0.0 to < 04.07.01 (FW29)affected

WAGO TP600 0762-620x/8000-000x

Default version status: unaffected

  • 0.0.0 to < 04.07.01 (70)affected

WAGO TP600 0762-630x/8000-000x

Default version status: unaffected

  • 0.0.0 to < 04.07.01 (FW29)affected

WAGO TP600 0762-630x/8000-000x

Default version status: unaffected

  • 0.0.0 to < 04.07.01 (70)affected

WAGO Edge Controller 0752-8303/8000-0002

Default version status: unaffected

  • 0.0.0 to < 04.07.01 (FW29)affected

WAGO Edge Controller 0752-8303/8000-0002

Default version status: unaffected

  • 0.0.0 to < 04.07.01 (70)affected

References