{
  "document": {
    "acknowledgments": [
      {
        "organization": "CERT@VDE",
        "summary": "coordination",
        "urls": [
          "https://certvde.com"
        ]
      }
    ],
    "aggregate_severity": {
      "namespace": "https://www.first.org/cvss/v3.1/specification-document#Qualitative-Severity-Rating-Scale",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-GB",
    "notes": [
      {
        "category": "summary",
        "text": "Critical vulnerabilities in the PHP runtime may allow a remote attacker to execute arbitrary code by exploiting weaknesses in PHP's internal memory and request handling mechanisms. Under specific conditions, specially crafted web requests can trigger unexpected behavior that could compromise the affected web server process. WAGO controllers with the integrated web server enabled and running an affected PHP version are exposed to these vulnerabilities.",
        "title": "Summary"
      },
      {
        "category": "description",
        "text": "Successful exploitation could allow an attacker to gain control over the affected PHP process through the web interface, potentially leading to unauthorized access, manipulation of application data, or disruption of device functionality.",
        "title": "Impact"
      },
      {
        "category": "description",
        "text": "Update the device to Firmware Version 4.10.4 (FW32) or later. Until FW32 is available, customers using Firmware Version 4.9.1 (FW31) should install the corresponding IPK security patch, which is available through the WAGO Download Center.",
        "title": "Remediation"
      },
      {
        "category": "description",
        "text": "To mitigate these vulnerabilities, disable the device's web server through the security settings. This prevents the vulnerabilities from being exploited via the web interface until a security update or patch has been applied.",
        "title": "Mitigation"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@wago.com",
      "name": "WAGO GmbH & Co. KG",
      "namespace": "https://www.wago.com/psirt"
    },
    "references": [
      {
        "category": "self",
        "summary": "WAGO PSIRT",
        "url": "https://www.wago.com/de-en/automation-technology/psirt"
      },
      {
        "category": "external",
        "summary": "CERT@VDE Security Advisories for WAGO",
        "url": "https://certvde.com/de/advisories/vendor/wago/"
      },
      {
        "category": "self",
        "summary": "VDE-2026-132: WAGO: Multiple Devices affected by PHP2Shell - HTML",
        "url": "https://certvde.com/en/advisories/VDE-2026-132"
      },
      {
        "category": "self",
        "summary": "VDE-2026-132: WAGO: Multiple Devices affected by PHP2Shell - CSAF",
        "url": "https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-132.json"
      }
    ],
    "title": "WAGO: Multiple Devices affected by PHP2Shell",
    "tracking": {
      "aliases": [
        "VDE-2026-132"
      ],
      "current_release_date": "2026-11-02T11:00:00.000Z",
      "generator": {
        "date": "2026-11-02T10:04:14.903Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.6.16"
        }
      },
      "id": "VDE-2026-132",
      "initial_release_date": "2026-11-02T11:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-11-02T11:00:00.000Z",
          "number": "1.0.0",
          "summary": "Release version."
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "CC100",
                "product": {
                  "name": "CC100",
                  "product_id": "CSAFPID-11001",
                  "product_identification_helper": {
                    "model_numbers": [
                      "0751-9?0?"
                    ]
                  }
                }
              },
              {
                "category": "product_name",
                "name": "PFC100 G2",
                "product": {
                  "name": "PFC100 G2",
                  "product_id": "CSAFPID-11002",
                  "product_identification_helper": {
                    "model_numbers": [
                      "0750-811?-????-????"
                    ]
                  }
                }
              },
              {
                "category": "product_name",
                "name": "PFC200 G2",
                "product": {
                  "name": "PFC200 G2",
                  "product_id": "CSAFPID-11003",
                  "product_identification_helper": {
                    "model_numbers": [
                      "0750-821?-???-???"
                    ]
                  }
                }
              },
              {
                "category": "product_name",
                "name": "TP600",
                "product": {
                  "name": "TP600",
                  "product_id": "CSAFPID-11004",
                  "product_identification_helper": {
                    "model_numbers": [
                      "0762-420?-8000-000?",
                      "0762-430?-8000-000?",
                      "0762-520?-8000-000?",
                      "0762-530?-8000-000?",
                      "0762-620?-8000-000?",
                      "0762-630?-8000-000?"
                    ]
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Edge Controller",
                "product": {
                  "name": "Edge Controller",
                  "product_id": "CSAFPID-11010",
                  "product_identification_helper": {
                    "model_numbers": [
                      "0752-8303-8000-0002"
                    ]
                  }
                }
              },
              {
                "category": "product_name",
                "name": "WP400",
                "product": {
                  "name": "WP400",
                  "product_id": "CSAFPID-11012",
                  "product_identification_helper": {
                    "model_numbers": [
                      "0762-340?"
                    ]
                  }
                }
              },
              {
                "category": "product_name",
                "name": "PFC300",
                "product": {
                  "name": "PFC300",
                  "product_id": "CSAFPID-11011",
                  "product_identification_helper": {
                    "model_numbers": [
                      "0750-8302"
                    ]
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Hardware"
          },
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:semver/>=1.0.0|<4.10.4",
                    "product": {
                      "name": "wago_os_linux <4.10.4 (FW32)",
                      "product_id": "CSAFPID-21001",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:o:wago:wago_os_linux:*:*:*:*:*:*:*:*"
                      }
                    }
                  },
                  {
                    "category": "product_name",
                    "name": "4.10.4",
                    "product": {
                      "name": "wago_os_linux 4.10.4 (FW32)",
                      "product_id": "CSAFPID-22001",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:o:wago:wago_os_linux:4.10.4:*:*:*:*:*:*:*"
                      }
                    }
                  }
                ],
                "category": "product_family",
                "name": "wago_os_linux"
              }
            ],
            "category": "product_family",
            "name": "Firmware"
          }
        ],
        "category": "vendor",
        "name": "WAGO"
      }
    ],
    "product_groups": [
      {
        "group_id": "CSAFGID-0001",
        "product_ids": [
          "CSAFPID-31001",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004",
          "CSAFPID-31010",
          "CSAFPID-31012",
          "CSAFPID-31011"
        ],
        "summary": "Affected products."
      },
      {
        "group_id": "CSAFGID-0002",
        "product_ids": [
          "CSAFPID-32001",
          "CSAFPID-32002",
          "CSAFPID-32003",
          "CSAFPID-32004",
          "CSAFPID-32010",
          "CSAFPID-32012",
          "CSAFPID-32011"
        ],
        "summary": "Fixed products."
      }
    ],
    "relationships": [
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "wago_os_linux <4.10.4 (FW32) installed on CC100",
          "product_id": "CSAFPID-31001",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:wago:wago_os_linux:*:*:*:*:*:*:*:*",
            "model_numbers": [
              "0751-9?01"
            ]
          }
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11001"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "wago_os_linux <4.10.4 (FW32) installed on PFC100 G2",
          "product_id": "CSAFPID-31002",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:wago:wago_os_linux:*:*:*:*:*:*:*:*",
            "model_numbers": [
              "0750-811?-????-????"
            ]
          }
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11002"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "wago_os_linux <4.10.4 (FW32) installed on PFC200 G2",
          "product_id": "CSAFPID-31003",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:wago:wago_os_linux:*:*:*:*:*:*:*:*",
            "model_numbers": [
              "0750-821?-???-???"
            ]
          }
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11003"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "wago_os_linux <4.10.4 (FW32) installed on TP600",
          "product_id": "CSAFPID-31004",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:wago:wago_os_linux:*:*:*:*:*:*:*:*",
            "model_numbers": [
              "0762-420?-8000-000?",
              "0762-430?-8000-000?",
              "0762-520?-8000-000?",
              "0762-530?-8000-000?",
              "0762-620?-8000-000?",
              "0762-630?-8000-000?"
            ]
          }
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11004"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "wago_os_linux <4.10.4 (FW32) installed on Edge Controller",
          "product_id": "CSAFPID-31010",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:wago:wago_os_linux:*:*:*:*:*:*:*:*",
            "model_numbers": [
              "0752-8303-8000-0002"
            ]
          }
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11010"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "wago_os_linux <4.10.4 (FW32) installed on WP400",
          "product_id": "CSAFPID-31012",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:wago:wago_os_linux:*:*:*:*:*:*:*:*",
            "model_numbers": [
              "0762-340?"
            ]
          }
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11012"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "wago_os_linux <4.10.4 (FW32) installed on PFC300",
          "product_id": "CSAFPID-31011",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:wago:wago_os_linux:*:*:*:*:*:*:*:*",
            "model_numbers": [
              "0750-8302"
            ]
          }
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11011"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "wago_os_linux 4.10.4 (FW32) installed on CC100",
          "product_id": "CSAFPID-32001",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:wago:wago_os_linux:4.10.4:*:*:*:*:*:*:*",
            "model_numbers": [
              "0751-9?01"
            ]
          }
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11001"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "wago_os_linux 4.10.4 (FW32) installed on PFC100 G2",
          "product_id": "CSAFPID-32002",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:wago:wago_os_linux:4.10.4:*:*:*:*:*:*:*",
            "model_numbers": [
              "0750-811?-????-????"
            ]
          }
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11002"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "wago_os_linux 4.10.4 (FW32) installed on PFC200 G2",
          "product_id": "CSAFPID-32003",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:wago:wago_os_linux:4.10.4:*:*:*:*:*:*:*",
            "model_numbers": [
              "0750-821?-???-???"
            ]
          }
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11003"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "wago_os_linux 4.10.4 (FW32) installed on TP600",
          "product_id": "CSAFPID-32004",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:wago:wago_os_linux:4.10.4:*:*:*:*:*:*:*",
            "model_numbers": [
              "0762-420?-8000-000?",
              "0762-430?-8000-000?",
              "0762-520?-8000-000?",
              "0762-530?-8000-000?",
              "0762-620?-8000-000?",
              "0762-630?-8000-000?"
            ]
          }
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11004"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "wago_os_linux 4.10.4 (FW32) installed on Edge Controller",
          "product_id": "CSAFPID-32010",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:wago:wago_os_linux:4.10.4:*:*:*:*:*:*:*",
            "model_numbers": [
              "0752-8303-8000-0002"
            ]
          }
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11010"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "wago_os_linux 4.10.4 (FW32) installed on WP400",
          "product_id": "CSAFPID-32012",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:wago:wago_os_linux:4.10.4:*:*:*:*:*:*:*",
            "model_numbers": [
              "0762-340?"
            ]
          }
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11012"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "wago_os_linux 4.10.4 (FW32) installed on PFC300",
          "product_id": "CSAFPID-32011",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:wago:wago_os_linux:4.10.4:*:*:*:*:*:*:*",
            "model_numbers": [
              "0750-8302"
            ]
          }
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11011"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-109618",
      "cwe": {
        "id": "CWE-1325",
        "name": "Improperly Controlled Sequential Memory Allocation"
      },
      "notes": [
        {
          "category": "description",
          "text": "PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-32001",
          "CSAFPID-32002",
          "CSAFPID-32003",
          "CSAFPID-32004",
          "CSAFPID-32010",
          "CSAFPID-32012",
          "CSAFPID-32011"
        ],
        "known_affected": [
          "CSAFPID-31001",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004",
          "CSAFPID-31010",
          "CSAFPID-31012",
          "CSAFPID-31011"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - 9.2 / Critical",
          "url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update the device to Firmware Version 4.10.4 (FW32) or later. Until FW32 is available, customers using Firmware Version 4.9.1 (FW31) should install the corresponding IPK security patch, which is available through the WAGO Download Center.",
          "group_ids": [
            "CSAFGID-0001"
          ],
          "url": "https://downloadcenter.wago.com/wago/software/details/mvkusgd8xpj5peomej"
        },
        {
          "category": "mitigation",
          "details": "To mitigate the vulnerability, disable the device's web server through the security settings. This prevents the vulnerability from being exploited via the web interface until a security update or patch has been applied.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 9.8,
            "environmentalSeverity": "CRITICAL",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 9.8,
            "temporalSeverity": "CRITICAL",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-31001",
            "CSAFPID-31002",
            "CSAFPID-31003",
            "CSAFPID-31004",
            "CSAFPID-31010",
            "CSAFPID-31012",
            "CSAFPID-31011"
          ]
        }
      ],
      "title": "RCE via OOM corruption"
    },
    {
      "cve": "CVE-2026-109619",
      "cwe": {
        "id": "CWE-1325",
        "name": "Improperly Controlled Sequential Memory Allocation"
      },
      "notes": [
        {
          "category": "description",
          "text": "PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-32001",
          "CSAFPID-32002",
          "CSAFPID-32003",
          "CSAFPID-32004",
          "CSAFPID-32010",
          "CSAFPID-32012",
          "CSAFPID-32011"
        ],
        "known_affected": [
          "CSAFPID-31001",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004",
          "CSAFPID-31010",
          "CSAFPID-31012",
          "CSAFPID-31011"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - 9.2 / Critical",
          "url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update the device to Firmware Version 4.10.4 (FW32) or later. Until FW32 is available, customers using Firmware Version 4.9.1 (FW31) should install the corresponding IPK security patch, which is available through the WAGO Download Center.",
          "group_ids": [
            "CSAFGID-0001"
          ],
          "url": "https://downloadcenter.wago.com/wago/software/details/mvkusgd8xpj5peomej"
        },
        {
          "category": "mitigation",
          "details": "To mitigate the vulnerability, disable the device's web server through the security settings. This prevents the vulnerability from being exploited via the web interface until a security update or patch has been applied.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 8.1,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 8.1,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-31001",
            "CSAFPID-31002",
            "CSAFPID-31003",
            "CSAFPID-31004",
            "CSAFPID-31010",
            "CSAFPID-31012",
            "CSAFPID-31011"
          ]
        }
      ],
      "title": "RCE via stale global state"
    }
  ]
}