{
  "document": {
    "acknowledgments": [
      {
        "organization": "CERT@VDE",
        "summary": "coordination",
        "urls": [
          "https://certvde.com"
        ]
      }
    ],
    "aggregate_severity": {
      "namespace": "https://www.first.org/cvss/v3.1/specification-document#Qualitative-Severity-Rating-Scale",
      "text": "Medium"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-GB",
    "notes": [
      {
        "category": "summary",
        "text": "Vulnerabilities have been discovered in the WAGO Device Manager that allow any origin to access the server and set header values, as well as an endpoint that permits read access to the file system. The WAGO Device Manager is a software for configuring and parameterizing single WAGO products, which is included in the firmware. These vulnerabilities could be exploited by attackers to send requests and read server responses through crafted web applications or to access the file system.",
        "title": "Summary"
      },
      {
        "category": "description",
        "text": "The vulnerabilities in the WAGO Device Manager allow unauthorized access to server resources, data leakage, remote exploitation, and compromise of device integrity. Attackers can exploit these vulnerabilities to access sensitive information, perform malicious actions remotely, and identify additional weaknesses, potentially leading to data breaches and further security issues.",
        "title": "Impact"
      },
      {
        "category": "description",
        "text": "Update to Firmware version 04.07.01 (FW29) or 03.10.11 (FW22 Patch 2). For the latest Custom Firmware please contact the WAGO support.",
        "title": "Remediation"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@wago.com",
      "name": "WAGO GmbH & Co. KG",
      "namespace": "https://www.wago.com/psirt"
    },
    "references": [
      {
        "category": "external",
        "summary": "WAGO PSIRT",
        "url": "https://www.wago.com/de-en/automation-technology/psirt"
      },
      {
        "category": "external",
        "summary": "CERT@VDE Security Advisories for WAGO",
        "url": "https://certvde.com/de/advisories/vendor/wago/"
      },
      {
        "category": "self",
        "summary": "VDE-2025-018: WAGO: Vulnerabilities in WAGO Device Manager - HTML",
        "url": "https://certvde.com/en/advisories/VDE-2025-018"
      },
      {
        "category": "self",
        "summary": "VDE-2025-018: WAGO: Vulnerabilities in WAGO Device Manager - CSAF",
        "url": "https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2025/vde-2025-018.json"
      }
    ],
    "title": "WAGO: Vulnerabilities in WAGO Device Manager",
    "tracking": {
      "aliases": [
        "VDE-2025-018"
      ],
      "current_release_date": "2025-11-21T12:00:00.000Z",
      "generator": {
        "date": "2025-11-21T11:28:39.863Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.5.38"
        }
      },
      "id": "VDE-2025-018",
      "initial_release_date": "2025-06-16T10:00:00.000Z",
      "revision_history": [
        {
          "date": "2025-06-16T10:00:00.000Z",
          "number": "1.0.0",
          "summary": "Initial release."
        },
        {
          "summary": "Removed incorrect custom firmware versions.",
          "number": "1.1.0",
          "date": "2025-07-04T10:00:00.000Z"
        },
        {
          "date": "2025-10-07T08:00:00.000Z",
          "number": "1.1.1",
          "summary": "Fixed a typo in the description for CVE-2025-25264 "
        },
        {
          "number": "1.2.0",
          "summary": "The two CVE descriptions and CVSS scores were edited.",
          "date": "2025-11-21T12:00:00.000Z"
        }
      ],
      "status": "final",
      "version": "1.2.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_name",
                    "name": "0751-9x01",
                    "product": {
                      "name": "CC100 0751-9x01",
                      "product_id": "CSAFPID-11001"
                    }
                  }
                ],
                "category": "product_family",
                "name": "CC100"
              },
              {
                "branches": [
                  {
                    "category": "product_name",
                    "name": "0750-810x/xxxx-xxxx",
                    "product": {
                      "name": "PFC100 G1 0750-810x/xxxx-xxxx",
                      "product_id": "CSAFPID-11002"
                    }
                  }
                ],
                "category": "product_family",
                "name": "PFC100 G1"
              },
              {
                "branches": [
                  {
                    "category": "product_name",
                    "name": "0750-811x-xxxx-xxxx",
                    "product": {
                      "name": "PFC100 G2 0750-811x-xxxx-xxxx",
                      "product_id": "CSAFPID-11003"
                    }
                  }
                ],
                "category": "product_family",
                "name": "PFC100 G2"
              },
              {
                "branches": [
                  {
                    "category": "product_name",
                    "name": "750-820x-xxx-xxx",
                    "product": {
                      "name": "PFC200 G1 750-820x-xxx-xxx",
                      "product_id": "CSAFPID-11004"
                    }
                  }
                ],
                "category": "product_family",
                "name": "PFC200 G1"
              },
              {
                "branches": [
                  {
                    "category": "product_name",
                    "name": "750-821x-xxx-xxx",
                    "product": {
                      "name": "PFC200 G2 750-821x-xxx-xxx",
                      "product_id": "CSAFPID-11005"
                    }
                  }
                ],
                "category": "product_family",
                "name": "PFC200 G2"
              },
              {
                "branches": [
                  {
                    "category": "product_name",
                    "name": "0762-420x/8000-000x",
                    "product": {
                      "name": "TP600 0762-420x/8000-000x",
                      "product_id": "CSAFPID-11006"
                    }
                  },
                  {
                    "category": "product_name",
                    "name": "0762-430x/8000-000x",
                    "product": {
                      "name": "TP600 0762-430x/8000-000x",
                      "product_id": "CSAFPID-11007"
                    }
                  },
                  {
                    "category": "product_name",
                    "name": "0762-520x/8000-000x",
                    "product": {
                      "name": "TP600 0762-520x/8000-000x",
                      "product_id": "CSAFPID-11008"
                    }
                  },
                  {
                    "category": "product_name",
                    "name": "0762-530x/8000-000x",
                    "product": {
                      "name": "TP600 0762-530x/8000-000x",
                      "product_id": "CSAFPID-11009"
                    }
                  },
                  {
                    "category": "product_name",
                    "name": "0762-620x/8000-000x",
                    "product": {
                      "name": "TP600 0762-620x/8000-000x",
                      "product_id": "CSAFPID-11010"
                    }
                  },
                  {
                    "category": "product_name",
                    "name": "0762-630x/8000-000x",
                    "product": {
                      "name": "TP600 0762-630x/8000-000x",
                      "product_id": "CSAFPID-11011"
                    }
                  }
                ],
                "category": "product_family",
                "name": "TP600"
              },
              {
                "branches": [
                  {
                    "category": "product_name",
                    "name": "0752-8303/8000-0002",
                    "product": {
                      "name": "Edge Controller 0752-8303/8000-0002",
                      "product_id": "CSAFPID-11012",
                      "product_identification_helper": {
                        "model_numbers": [
                          "0752-8303/8000-0002"
                        ]
                      }
                    }
                  }
                ],
                "category": "product_family",
                "name": "Edge Controller"
              }
            ],
            "category": "product_family",
            "name": "Hardware"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "<04.07.01",
                "product": {
                  "name": "WAGO Firmware <04.07.01 (FW29)",
                  "product_id": "CSAFPID-21001"
                }
              },
              {
                "category": "product_name",
                "name": "04.07.01",
                "product": {
                  "name": "WAGO Firmware 04.07.01 (FW29)",
                  "product_id": "CSAFPID-22001"
                }
              },
              {
                "category": "product_version_range",
                "name": "<03.10.11",
                "product": {
                  "name": "WAGO Firmware <3.10.11 (FW22 Patch 2)",
                  "product_id": "CSAFPID-21002"
                }
              },
              {
                "category": "product_version",
                "name": "03.10.11",
                "product": {
                  "name": "WAGO Firmware 03.10.11 (FW22 Patch 2)",
                  "product_id": "CSAFPID-22002"
                }
              },
              {
                "category": "product_version_range",
                "name": "<04.07.01 (70)",
                "product": {
                  "name": "Custom Firmware <04.07.01 (70)",
                  "product_id": "CSAFPID-21003"
                }
              },
              {
                "category": "product_version",
                "name": "04.07.01 (70)",
                "product": {
                  "name": "Custom Firmware 04.07.01 (70)",
                  "product_id": "CSAFPID-22003"
                }
              }
            ],
            "category": "product_family",
            "name": "Firmware"
          }
        ],
        "category": "vendor",
        "name": "WAGO"
      }
    ],
    "product_groups": [
      {
        "group_id": "CSAFGID-0001",
        "product_ids": [
          "CSAFPID-31001",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004",
          "CSAFPID-31005",
          "CSAFPID-31006",
          "CSAFPID-31007",
          "CSAFPID-31008",
          "CSAFPID-31009",
          "CSAFPID-31010",
          "CSAFPID-31011",
          "CSAFPID-31012",
          "CSAFPID-31013",
          "CSAFPID-31015",
          "CSAFPID-31017",
          "CSAFPID-31018",
          "CSAFPID-31019",
          "CSAFPID-31020",
          "CSAFPID-31021",
          "CSAFPID-31022",
          "CSAFPID-31023",
          "CSAFPID-31024"
        ],
        "summary": "Affected products."
      },
      {
        "group_id": "CSAFGID-0002",
        "product_ids": [
          "CSAFPID-32001",
          "CSAFPID-32002",
          "CSAFPID-32003",
          "CSAFPID-32004",
          "CSAFPID-32005",
          "CSAFPID-32006",
          "CSAFPID-32007",
          "CSAFPID-32008",
          "CSAFPID-32009",
          "CSAFPID-32010",
          "CSAFPID-32011",
          "CSAFPID-32012",
          "CSAFPID-32013",
          "CSAFPID-32015",
          "CSAFPID-32017",
          "CSAFPID-32018",
          "CSAFPID-32019",
          "CSAFPID-32020",
          "CSAFPID-32021",
          "CSAFPID-32022",
          "CSAFPID-32023",
          "CSAFPID-32024"
        ],
        "summary": "Fixed products."
      }
    ],
    "relationships": [
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "WAGO Firmware <04.07.01 (FW29) installed on CC100 0751-9x01",
          "product_id": "CSAFPID-31001"
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11001"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "WAGO Firmware <3.10.11 (FW22 Patch 2) installed on PFC100 G1 0750-810x/xxxx-xxxx",
          "product_id": "CSAFPID-31002"
        },
        "product_reference": "CSAFPID-21002",
        "relates_to_product_reference": "CSAFPID-11002"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "WAGO Firmware <04.07.01 (FW29) installed on PFC100 G2 0750-811x-xxxx-xxxx",
          "product_id": "CSAFPID-31003"
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11003"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "WAGO Firmware <3.10.11 (FW22 Patch 2) installed on PFC200 G1 750-820x-xxx-xxx",
          "product_id": "CSAFPID-31004"
        },
        "product_reference": "CSAFPID-21002",
        "relates_to_product_reference": "CSAFPID-11004"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "WAGO Firmware <04.07.01 (FW29) installed on PFC200 G2 750-821x-xxx-xxx",
          "product_id": "CSAFPID-31005"
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11005"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "WAGO Firmware <04.07.01 (FW29) installed on TP600 0762-420x/8000-000x",
          "product_id": "CSAFPID-31006"
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11006"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "WAGO Firmware <04.07.01 (FW29) installed on TP600 0762-430x/8000-000x",
          "product_id": "CSAFPID-31007"
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11007"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "WAGO Firmware <04.07.01 (FW29) installed on TP600 0762-520x/8000-000x",
          "product_id": "CSAFPID-31008"
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11008"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "WAGO Firmware <04.07.01 (FW29) installed on TP600 0762-530x/8000-000x",
          "product_id": "CSAFPID-31009"
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11009"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "WAGO Firmware <04.07.01 (FW29) installed on TP600 0762-620x/8000-000x",
          "product_id": "CSAFPID-31010"
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11010"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "WAGO Firmware <04.07.01 (FW29) installed on TP600 0762-630x/8000-000x",
          "product_id": "CSAFPID-31011"
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11011"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "WAGO Firmware <04.07.01 (FW29) installed on Edge Controller 0752-8303/8000-0002",
          "product_id": "CSAFPID-31012"
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11012"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "WAGO Firmware 04.07.01 (FW29) installed on CC100 0751-9x01",
          "product_id": "CSAFPID-32001"
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11001"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "WAGO Firmware 03.10.11 (FW22 Patch 2) installed on PFC100 G1 0750-810x/xxxx-xxxx",
          "product_id": "CSAFPID-32002"
        },
        "product_reference": "CSAFPID-22002",
        "relates_to_product_reference": "CSAFPID-11002"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "WAGO Firmware 04.07.01 (FW29) installed on PFC100 G2 0750-811x-xxxx-xxxx",
          "product_id": "CSAFPID-32003"
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11003"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "WAGO Firmware 03.10.11 (FW22 Patch 2) installed on PFC200 G1 750-820x-xxx-xxx",
          "product_id": "CSAFPID-32004"
        },
        "product_reference": "CSAFPID-22002",
        "relates_to_product_reference": "CSAFPID-11004"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "WAGO Firmware 04.07.01 (FW29) installed on PFC200 G2 750-821x-xxx-xxx",
          "product_id": "CSAFPID-32005"
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11005"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "WAGO Firmware 04.07.01 (FW29) installed on TP600 0762-420x/8000-000x",
          "product_id": "CSAFPID-32006"
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11006"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "WAGO Firmware 04.07.01 (FW29) installed on TP600 0762-430x/8000-000x",
          "product_id": "CSAFPID-32007"
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11007"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "WAGO Firmware 04.07.01 (FW29) installed on TP600 0762-520x/8000-000x",
          "product_id": "CSAFPID-32008"
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11008"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "WAGO Firmware 04.07.01 (FW29) installed on TP600 0762-530x/8000-000x",
          "product_id": "CSAFPID-32009"
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11009"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "WAGO Firmware 04.07.01 (FW29) installed on TP600 0762-620x/8000-000x",
          "product_id": "CSAFPID-32010"
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11010"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "WAGO Firmware 04.07.01 (FW29) installed on TP600 0762-630x/8000-000x",
          "product_id": "CSAFPID-32011"
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11011"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "WAGO Firmware 04.07.01 (FW29) installed on Edge Controller 0752-8303/8000-0002",
          "product_id": "CSAFPID-32012"
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11012"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Custom Firmware <04.07.01 (70) installed on CC100 0751-9x01",
          "product_id": "CSAFPID-31013"
        },
        "product_reference": "CSAFPID-21003",
        "relates_to_product_reference": "CSAFPID-11001"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Custom Firmware <04.07.01 (70) installed on PFC100 G2 0750-811x-xxxx-xxxx",
          "product_id": "CSAFPID-31015"
        },
        "product_reference": "CSAFPID-21003",
        "relates_to_product_reference": "CSAFPID-11003"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Custom Firmware <04.07.01 (70) installed on PFC200 G2 750-821x-xxx-xxx",
          "product_id": "CSAFPID-31017"
        },
        "product_reference": "CSAFPID-21003",
        "relates_to_product_reference": "CSAFPID-11005"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Custom Firmware <04.07.01 (70) installed on TP600 0762-420x/8000-000x",
          "product_id": "CSAFPID-31018"
        },
        "product_reference": "CSAFPID-21003",
        "relates_to_product_reference": "CSAFPID-11006"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Custom Firmware <04.07.01 (70) installed on TP600 0762-430x/8000-000x",
          "product_id": "CSAFPID-31019"
        },
        "product_reference": "CSAFPID-21003",
        "relates_to_product_reference": "CSAFPID-11007"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Custom Firmware <04.07.01 (70) installed on TP600 0762-520x/8000-000x",
          "product_id": "CSAFPID-31020"
        },
        "product_reference": "CSAFPID-21003",
        "relates_to_product_reference": "CSAFPID-11008"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Custom Firmware <04.07.01 (70) installed on TP600 0762-530x/8000-000x",
          "product_id": "CSAFPID-31021"
        },
        "product_reference": "CSAFPID-21003",
        "relates_to_product_reference": "CSAFPID-11009"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Custom Firmware <04.07.01 (70) installed on TP600 0762-620x/8000-000x",
          "product_id": "CSAFPID-31022"
        },
        "product_reference": "CSAFPID-21003",
        "relates_to_product_reference": "CSAFPID-11010"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Custom Firmware <04.07.01 (70) installed on TP600 0762-630x/8000-000x",
          "product_id": "CSAFPID-31023"
        },
        "product_reference": "CSAFPID-21003",
        "relates_to_product_reference": "CSAFPID-11011"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Custom Firmware <04.07.01 (70) installed on Edge Controller 0752-8303/8000-0002",
          "product_id": "CSAFPID-31024"
        },
        "product_reference": "CSAFPID-21003",
        "relates_to_product_reference": "CSAFPID-11012"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Custom Firmware 04.07.01 (70) installed on CC100 0751-9x01",
          "product_id": "CSAFPID-32013"
        },
        "product_reference": "CSAFPID-22003",
        "relates_to_product_reference": "CSAFPID-11001"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Custom Firmware 04.07.01 (70) installed on PFC100 G2 0750-811x-xxxx-xxxx",
          "product_id": "CSAFPID-32015"
        },
        "product_reference": "CSAFPID-22003",
        "relates_to_product_reference": "CSAFPID-11003"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Custom Firmware 04.07.01 (70) installed on PFC200 G2 750-821x-xxx-xxx",
          "product_id": "CSAFPID-32017"
        },
        "product_reference": "CSAFPID-22003",
        "relates_to_product_reference": "CSAFPID-11005"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Custom Firmware 04.07.01 (70) installed on TP600 0762-420x/8000-000x",
          "product_id": "CSAFPID-32018"
        },
        "product_reference": "CSAFPID-22003",
        "relates_to_product_reference": "CSAFPID-11006"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Custom Firmware 04.07.01 (70) installed on TP600 0762-430x/8000-000x",
          "product_id": "CSAFPID-32019"
        },
        "product_reference": "CSAFPID-22003",
        "relates_to_product_reference": "CSAFPID-11007"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Custom Firmware 04.07.01 (70) installed on TP600 0762-520x/8000-000x",
          "product_id": "CSAFPID-32020"
        },
        "product_reference": "CSAFPID-22003",
        "relates_to_product_reference": "CSAFPID-11008"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Custom Firmware 04.07.01 (70) installed on TP600 0762-530x/8000-000x",
          "product_id": "CSAFPID-32021"
        },
        "product_reference": "CSAFPID-22003",
        "relates_to_product_reference": "CSAFPID-11009"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Custom Firmware 04.07.01 (70) installed on TP600 0762-620x/8000-000x",
          "product_id": "CSAFPID-32022"
        },
        "product_reference": "CSAFPID-22003",
        "relates_to_product_reference": "CSAFPID-11010"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Custom Firmware 04.07.01 (70) installed on TP600 0762-630x/8000-000x",
          "product_id": "CSAFPID-32023"
        },
        "product_reference": "CSAFPID-22003",
        "relates_to_product_reference": "CSAFPID-11011"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Custom Firmware 04.07.01 (70) installed on Edge Controller 0752-8303/8000-0002",
          "product_id": "CSAFPID-32024"
        },
        "product_reference": "CSAFPID-22003",
        "relates_to_product_reference": "CSAFPID-11012"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-25264",
      "cwe": {
        "id": "CWE-942",
        "name": "Permissive Cross-domain Policy with Untrusted Domains"
      },
      "notes": [
        {
          "category": "description",
          "text": "An unauthenticated remote attacker can trick an admin to visit a website containing malicious java script code. The current overly permissive CORS policy allows the attacker to obtain any files from the file system. ",
          "title": "CVE Description"
        },
        {
          "category": "details",
          "text": "The current CORS configuration allows the setting of the header values relevant for authentication, as well as the access and reading of HTTP responses, starting from any origins. This can lead to attackers preparing a corresponding Web application, which can be accessed via the Internet, for example, in such a way that they transmit relevant HTTP requests in the background against the Web application running on the controller.",
          "title": "CVE Details"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-32001",
          "CSAFPID-32002",
          "CSAFPID-32003",
          "CSAFPID-32004",
          "CSAFPID-32005",
          "CSAFPID-32006",
          "CSAFPID-32007",
          "CSAFPID-32008",
          "CSAFPID-32009",
          "CSAFPID-32010",
          "CSAFPID-32011",
          "CSAFPID-32012",
          "CSAFPID-32013",
          "CSAFPID-32015",
          "CSAFPID-32017",
          "CSAFPID-32018",
          "CSAFPID-32019",
          "CSAFPID-32020",
          "CSAFPID-32021",
          "CSAFPID-32022",
          "CSAFPID-32023",
          "CSAFPID-32024"
        ],
        "known_affected": [
          "CSAFPID-31001",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004",
          "CSAFPID-31005",
          "CSAFPID-31006",
          "CSAFPID-31007",
          "CSAFPID-31008",
          "CSAFPID-31009",
          "CSAFPID-31010",
          "CSAFPID-31011",
          "CSAFPID-31012",
          "CSAFPID-31013",
          "CSAFPID-31015",
          "CSAFPID-31017",
          "CSAFPID-31018",
          "CSAFPID-31019",
          "CSAFPID-31020",
          "CSAFPID-31021",
          "CSAFPID-31022",
          "CSAFPID-31023",
          "CSAFPID-31024"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to Firmware version 04.07.01 (FW29) or 03.10.11 (FW22 Patch 2). For the latest Custom Firmware please contact the WAGO support.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 6.5,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 6.5,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-31001",
            "CSAFPID-31002",
            "CSAFPID-31003",
            "CSAFPID-31004",
            "CSAFPID-31005",
            "CSAFPID-31006",
            "CSAFPID-31007",
            "CSAFPID-31008",
            "CSAFPID-31009",
            "CSAFPID-31010",
            "CSAFPID-31011",
            "CSAFPID-31012",
            "CSAFPID-31013",
            "CSAFPID-31015",
            "CSAFPID-31017",
            "CSAFPID-31018",
            "CSAFPID-31019",
            "CSAFPID-31020",
            "CSAFPID-31021",
            "CSAFPID-31022",
            "CSAFPID-31023",
            "CSAFPID-31024"
          ]
        }
      ],
      "title": "CVE-2025-25264"
    },
    {
      "cve": "CVE-2025-25265",
      "cwe": {
        "id": "CWE-306",
        "name": "Missing Authentication for Critical Function"
      },
      "notes": [
        {
          "category": "description",
          "text": "A web application for configuring the controller is accessible at a specific path. It contains an endpoint that allows a high privileged remote attacker to read files from the system’s file structure.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-32001",
          "CSAFPID-32002",
          "CSAFPID-32003",
          "CSAFPID-32004",
          "CSAFPID-32005",
          "CSAFPID-32006",
          "CSAFPID-32007",
          "CSAFPID-32008",
          "CSAFPID-32009",
          "CSAFPID-32010",
          "CSAFPID-32011",
          "CSAFPID-32012",
          "CSAFPID-32013",
          "CSAFPID-32015",
          "CSAFPID-32017",
          "CSAFPID-32018",
          "CSAFPID-32019",
          "CSAFPID-32020",
          "CSAFPID-32021",
          "CSAFPID-32022",
          "CSAFPID-32023",
          "CSAFPID-32024"
        ],
        "known_affected": [
          "CSAFPID-31001",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004",
          "CSAFPID-31005",
          "CSAFPID-31006",
          "CSAFPID-31007",
          "CSAFPID-31008",
          "CSAFPID-31009",
          "CSAFPID-31010",
          "CSAFPID-31011",
          "CSAFPID-31012",
          "CSAFPID-31013",
          "CSAFPID-31015",
          "CSAFPID-31017",
          "CSAFPID-31018",
          "CSAFPID-31019",
          "CSAFPID-31020",
          "CSAFPID-31021",
          "CSAFPID-31022",
          "CSAFPID-31023",
          "CSAFPID-31024"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to Firmware version 04.07.01 (FW29) or 03.10.11 (FW22 Patch 2). For the latest Custom Firmware please contact the WAGO support.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 4.9,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "temporalScore": 4.9,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-31001",
            "CSAFPID-31002",
            "CSAFPID-31003",
            "CSAFPID-31004",
            "CSAFPID-31005",
            "CSAFPID-31006",
            "CSAFPID-31007",
            "CSAFPID-31008",
            "CSAFPID-31009",
            "CSAFPID-31010",
            "CSAFPID-31011",
            "CSAFPID-31012",
            "CSAFPID-31013",
            "CSAFPID-31015",
            "CSAFPID-31017",
            "CSAFPID-31018",
            "CSAFPID-31019",
            "CSAFPID-31020",
            "CSAFPID-31021",
            "CSAFPID-31022",
            "CSAFPID-31023",
            "CSAFPID-31024"
          ]
        }
      ],
      "title": "CVE-2025-25265"
    }
  ]
}