Wago PFC100 g1 0750-810x/xxxx-Xxxx vulnerabilities

7 CVEs affecting Wago PFC100 g1 0750-810x/xxxx-Xxxx, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-25265, published 2025-06-16.

More from Wago.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2024-41969, published 2024-11-18. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. A low privileged remote attacker may modify the configuration of the CODESYS V3 service through a missing authentication vulnerability which could lead to full system access and/or DoS.
• CVE-2025-25265, published 2025-06-16. Medium severity, CVSS 4.9. EPSS: 0.5% chance of exploitation in the next 30 days. A web application for configuring the controller is accessible at a specific path. It contains an endpoint that allows a high privileged remote attacker to read files from the system’s file structure.
• CVE-2025-25264, published 2025-06-16. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. An unauthenticated remote attacker can trick an admin to visit a website containing malicious java script code. The current overly permissive CORS policy allows the attacker to obtain any files from…
• CVE-2024-41967, published 2024-11-18. High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days. A low privileged remote attacker may modify the boot mode configuration setup of the device, leading to modification of the firmware upgrade process or a denial-of-service attack.
• CVE-2025-0101, published 2025-04-16. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. A low privileged user can set the date of the devices to the 19th of January 2038 an therefore exceed the 32-Bit time limit. This causes some functions to work unexpected or stop working at all. Both…
• CVE-2024-41968, published 2024-11-18. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. A low privileged remote attacker may modify the docker settings setup of the device, leading to a limited DoS.
• CVE-2024-12650, published 2025-03-05. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. An attacker with low privileges can manipulate the requested memory size, causing the application to use an invalid memory area. This could lead to a crash of the application but it does not affected…