by Kastro
Paper/Archive/CVE-2025-41753

CVE-2025-41753

WAGO 0751-9x01 — Path traversal in dynamically created BACnet File Objects

EPSS 0.6%CVSS 9.8
critical.is priorityof 100
39
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 48.0.480 × 209.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation. Because relative paths are not limited to the intended directory, an unauthenticated remote attacker can traverse outside of it and read or overwrite arbitrary files on the device, which may lead to full system compromise.

Affected

ProductAffectedFixed inSource
0751-9x011.0.0 – < 4.8.94.8.9CNA
0750-811x-xxxx-xxxx1.0.0 – < 4.8.94.8.9CNA
0750-821x-xxx-xxx1.0.0 – < 4.8.94.8.9CNA
0762-420x-8000-000x1.0.0 – < 4.8.94.8.9CNA
0762-430x-8000-000x1.0.0 – < 4.8.94.8.9CNA
0762-520x-8000-000x1.0.0 – < 4.8.94.8.9CNA
0762-530x-8000-000x1.0.0 – < 4.8.94.8.9CNA
0762-620x-8000-000x1.0.0 – < 4.8.94.8.9CNA
0762-630x-8000-000x1.0.0 – < 4.8.94.8.9CNA
0752-8303-8000-00021.0.0 – < 4.8.94.8.9CNA
0762-340x1.0.0 – < 4.8.94.8.9CNA
0751-9x011.0.0 – < 4.8.9 (70)4.8.9 (70)CNA

Scores by source

CERTVDE (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CERTVDE (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcertvde.com/en/advisories/VDE-2025-102