Riskcovery

CVE-2025-25264

Overly Permissive CORS Policy in WAGO Device Manager

State
Published
Severity
6.5 Medium
Published
Jun 16, 2025
Updated
Nov 21, 2025
Reserved
Feb 6, 2025

Read the record on cve.org

Description

An unauthenticated remote attacker can trick an admin to visit a website containing malicious java script code. The current overly permissive CORS policy allows the attacker to obtain any files from the file system.

Scores

CVSSScoreVectorSource
3.16.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NCERTVDE

Weaknesses

  • CWE-942 Permissive Cross-domain Policy with Untrusted Domains

Affected Products

ProductVersions
CC100 0751-9x01WAGO
  • 0.0.0 to before 04.07.01 (FW29)Affected
CC100 0751-9x01WAGO
  • 0.0.0 to before 04.07.01 (70Affected
PFC100 G1 0750-810x/xxxx-xxxxWAGO
  • 0.0.0 to before 3.10.11 (FW22 Patch 2)Affected
PFC100 G2 0750-811x-xxxx-xxxxWAGO
  • 0.0.0 to before 04.07.01 (70)Affected
PFC200 G1 750-820x-xxx-xxxWAGO
  • 0.0.0 to before 3.10.11 (FW22 Patch 2)Affected
PFC200 G2 750-821x-xxx-xxxWAGO
  • 0.0.0 to before 04.07.01 (FW29)Affected
PFC200 G2 750-821x-xxx-xxxWAGO
  • 0.0.0 to before 04.07.01 (70)Affected
TP600 0762-420x/8000-000xWAGO
  • 0.0.0 to before 04.07.01 (FW29)Affected
TP600 0762-420x/8000-000xWAGO
  • 0.0.0 to before 04.07.01 (70)Affected
TP600 0762-430x/8000-000xWAGO
  • 0.0.0 to before 04.07.01 (FW29)Affected
TP600 0762-430x/8000-000xWAGO
  • 0.0.0 to before 04.07.01 (70)Affected
TP600 0762-520x/8000-000xWAGO
  • 0.0.0 to before 04.07.01 (FW29)Affected
TP600 0762-520x/8000-000xWAGO
  • 0.0.0 to before 04.07.01 (70)Affected
TP600 0762-530x/8000-000xWAGO
  • 0.0.0 to before 04.07.01 (FW29)Affected
TP600 0762-530x/8000-000xWAGO
  • 0.0.0 to before 04.07.01 (70)Affected
TP600 0762-620x/8000-000xWAGO
  • 0.0.0 to before 04.07.01 (FW29)Affected
TP600 0762-620x/8000-000xWAGO
  • 0.0.0 to before 04.07.01 (70)Affected
TP600 0762-630x/8000-000xWAGO
  • 0.0.0 to before 04.07.01 (FW29)Affected
TP600 0762-630x/8000-000xWAGO
  • 0.0.0 to before 04.07.01 (70)Affected
Edge Controller 0752-8303/8000-0002WAGO
  • 0.0.0 to before 04.07.01 (FW29)Affected
Edge Controller 0752-8303/8000-0002WAGO
  • 0.0.0 to before 04.07.01 (70)Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.