CVE-2024-1490

HighCVSS 7.2/10Last modified Nov 8, 2026

Description

An authenticated remote attacker with high privileges can exploit the OpenVPN configuration via the web-based management interface of a WAGO PLC. If user-defined scripts are permitted, OpenVPN may allow the execution of arbitrary shell commands enabling the attacker to run arbitrary commands on the device.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
WAGOCC100 (0751-9x01)>= 0.0.0, <= 4.5.10
WAGOPFC100 G1 (0750-810-xxxx-xxxx)>= 0.0.0, <= 3.10.10
WAGOPFC100 G2 (0750-811x-xxxx-xxxx)>= 0.0.0, <= 4.5.10
WAGOPFC200 G1 (750-820x-xxxx-xxxx)>= 0.0.0, <= 3.10.10
WAGOPFC200 G2 (750-821x-xxxx-xxxx)>= 0.0.0, <= 4.5.10
WAGOTP600 (0762-420x-8000-000x)>= 0.0.0, <= FW 26
WAGOTP600 (0762-430x-8000-000x)>= 0.0.0, <= 4.5.10
WAGOTP600 (0762-520x-8000-000x)>= 0.0.0, <= 4.5.10
WAGOTP600 (0762-530x-8000-000x)>= 0.0.0, <= 4.5.10
WAGOTP600 (0762-620x-8000-000x)0.0.0
WAGOTP600 (0762-630x-8000-000x)>= 0.0.0, <= 4.5.10
WAGOEdge Controller (0752-8303-8000-0002)>= 0.0.0, <= 4.5.10
WAGOWP400 (0762-340x)>= 0.0.0, <= 4.5.10

References

Timeline

Published
Apr 9, 2026
Last modified
Nov 8, 2026
NVD status
Awaiting Analysis

Related CVEs from 2024

CVE-2024-14917.5The devices allow access to an unprotected endpoint that allows MPFS file system binary image upload without authentication. The MPFS2 fileCVE-2024-14925.3The WPify Woo Czech plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the maybe_send_toCVE-2024-14936.5An issue was discovered in GitLab CE/EE affecting all versions starting from 9.2 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and sCVE-2024-14956.5An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.1 prior to 16.10.7, starting from 16.11 prior to 16.11.CVE-2024-14965.4The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the fifu_input_url parameter in allCVE-2024-14975.4The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form widget addr2_width attribute in alCVE-2024-14985.4The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Photo Stack Widget in all CVE-2024-14995.4The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Pricing Table widget in the $settings[CVE-2024-15005.4The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Logo Widget in all versioCVE-2024-15014.7The Database Reset plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.22. This is due CVE-2024-15024.3The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capabiCVE-2024-15034.3The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to,
CVE-2024-1490: High severity, CVSS 7.2 | Vulnix