CVE-2024-1490
High
Description
An authenticated remote attacker with high privileges can exploit the OpenVPN configuration via the web-based management interface of a WAGO PLC. If user-defined scripts are permitted, OpenVPN may allow the execution of arbitrary shell commands enabling the attacker to run arbitrary commands on the device.
SeverityHigh
CVSS7.2
Exploit probability—
ProductCC100 (0751-9x01)
PublishedApr 9, 2026
First seenApr 9, 2026
Weakness typeCWE-94Code injection
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| WAGO CC100 (0751-9x01) | v ≤ 4.5.10 | — |
| WAGO PFC100 G1 (0750-810-xxxx-xxxx) | v ≤ 3.10.10 | — |
| WAGO PFC100 G2 (0750-811x-xxxx-xxxx) | v ≤ 4.5.10 | — |
| WAGO PFC200 G1 (750-820x-xxxx-xxxx) | v ≤ 3.10.10 | — |
| WAGO PFC200 G2 (750-821x-xxxx-xxxx) | v ≤ 4.5.10 | — |
| WAGO TP600 (0762-420x-8000-000x) | v ≤ FW 26 | — |
| WAGO TP600 (0762-430x-8000-000x) | v ≤ 4.5.10 | — |
| WAGO TP600 (0762-520x-8000-000x) | v ≤ 4.5.10 | — |
| WAGO TP600 (0762-530x-8000-000x) | v ≤ 4.5.10 | — |
| WAGO TP600 (0762-620x-8000-000x) | 0.0.0 | — |
| WAGO TP600 (0762-630x-8000-000x) | v ≤ 4.5.10 | — |
| WAGO Edge Controller (0752-8303-8000-0002) | v ≤ 4.5.10 | — |
| WAGO WP400 (0762-340x) | v ≤ 4.5.10 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.