CVE-2025-41753: WAGO multiple devices path traversal in BACnet File Object

CVE-2025-41753 · Severity: critical · CVSS 9.8 · Published 2026-10-01

WAGO industrial controllers and automation devices support a building automation protocol (BACnet) that allows remote management. A flaw in how dynamically created file objects validate their names permits an unauthenticated attacker to read or overwrite any file on the device via path traversal, potentially exposing credentials or causing full system compromise.

Vendors: Wago.

Quick answers

Is CVE-2025-41753 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-41753 being exploited in the wild.
How severe is CVE-2025-41753?
Critical severity, with a CVSS score of 9.8, published 1 October 2026.
Which products and versions are affected?
Wago 750-811x wago_os_linux < 4.8.9 (FW30 and custom 70); Wago 750-821x wago_os_linux < 4.8.9 (FW30 and custom 70); Wago 751-9x01 wago_os_linux < 4.8.9 (FW30 and custom 70); Wago 752-8303-8000-0002 wago_os_linux < 4.8.9 (FW30 and custom 70); and 7 more.
Is there a fix for CVE-2025-41753?
Yes: fixed in wago_os_linux 4.8.9 (FW30); contact WAGO support for custom firmware 70. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-41753 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-41753?
Check whether you run Wago 750-811x, Wago 750-821x, Wago 751-9x01 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: wago_os_linux 4.8.9 (FW30); contact WAGO support for custom firmware 70

Technical details

The vulnerability is a path traversal (CWE-22) in BACnet File Object creation: the object name is used directly as a file path without restricting relative paths to an intended directory. An unauthenticated remote attacker can craft BACnet requests with object names containing directory traversal sequences (e.g., "../") to read or overwrite arbitrary files. The attack requires only network access to the BACnet IP interface and no authentication.

Affected products

  • WAGO 750-811x wago_os_linux < 4.8.9 (FW30 and custom 70)
  • WAGO 750-821x wago_os_linux < 4.8.9 (FW30 and custom 70)
  • WAGO 751-9x01 wago_os_linux < 4.8.9 (FW30 and custom 70)
  • WAGO 752-8303-8000-0002 wago_os_linux < 4.8.9 (FW30 and custom 70)
  • WAGO 762-340x wago_os_linux < 4.8.9 (FW30 and custom 70)
  • WAGO 762-420x-8000-000x wago_os_linux < 4.8.9 (FW30 and custom 70)
  • WAGO 762-430x-8000-000x wago_os_linux < 4.8.9 (FW30 and custom 70)
  • WAGO 762-520x-8000-000x wago_os_linux < 4.8.9 (FW30 and custom 70)
  • WAGO 762-530x-8000-000x wago_os_linux < 4.8.9 (FW30 and custom 70)
  • WAGO 762-620x-8000-000x wago_os_linux < 4.8.9 (FW30 and custom 70)
  • WAGO 762-630x-8000-000x wago_os_linux < 4.8.9 (FW30 and custom 70)

Timeline

  • 2026-10-01: disclosed
  • 2026-10-01: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.