WAGO Device Sphere JWT Token Forgery Vulnerability Allowing Unauthorized Access

A vulnerability exists in WAGO Device Sphere version 1.0.0, where identical default certificates are installed across all systems instead of unique ones. This flaw allows remote unauthenticated attackers to generate JSON Web Tokens (JWT) that are valid for all users, thereby gaining full access to the application and all connected devices.

Impact

Exploitation of this vulnerability allows for the forgery of JWTs, enabling unauthorized access to the application and connected devices. This impersonation can lead to a complete compromise of the system's security.

Remediation

Users are advised to update to WAGO Device Sphere version 1.0.1. Version 1.0.0 cannot be used after June 30, 2025.