WAGO Device Manager Unauthenticated File Read Vulnerability

A vulnerability exists in the WAGO Device Manager web application, which is used for configuring WAGO products. The issue allows unauthenticated remote attackers to read files from the system's file structure. This vulnerability arises because the application has an endpoint that can be accessed without authentication, enabling unauthorized access to sensitive files.

Impact

Exploitation of this vulnerability could lead to unauthorized access to the file system, allowing attackers to read sensitive files and potentially exploit other vulnerabilities or misconfigurations on the device.

Remediation

Users are advised to update to WAGO Device Manager firmware version 04.07.01 (FW29) or 03.10.11 (FW22 Patch 2). For the latest custom firmware, please contact WAGO support.