WAGO PLC Vulnerabilities: The Chain That Leads to Full Control

An OT security research team analyzed the programmable controller WAGO 750-8216/025-001 — a widely deployed platform in industrial automation — and uncovered eight distinct vulnerabilities. Taken individually some appear of limited severity, but the interesting finding of the research is something else: chained in a precise sequence, an attacker starting from a low-privilege account can reach full control of the device with root privileges.

The Eight Vulnerabilities in Summary

The flaws fall into two main families: improper access controls and path traversal.

CVE	Type	CVSS	Effect
CVE-2024-41969	Improper Access Control	7.1	Disables CODESYS authentication
CVE-2024-41971	Path Traversal	6.5	Arbitrary file deletion
CVE-2024-41973	Path Traversal	6.5	Arbitrary file copy
CVE-2024-41967	Improper Access Control	5.4	Access to diagnostic data
CVE-2024-41968	Improper Access Control	5.4	System settings modification
CVE-2024-41974	Improper Access Control	5.4	Access to reserved functions
CVE-2024-41970	Improper Access Control	5.3	Sensitive information read
CVE-2024-41972	Path Traversal	4.9	Arbitrary file read

How the Attack Chain Works

The value of this research lies in the chaining. An authenticated but low-privilege user first exploits CVE-2024-41969 to disable, through the web interface, authentication for the CODESYS client — the runtime environment that executes control logic. Once that barrier falls, the path traversal vulnerabilities (CVE-2024-41971 and CVE-2024-41973) allow writing malicious files to arbitrary filesystem locations. The final result is arbitrary code execution with root privileges.

In other words, an access that appeared innocuous on paper becomes the beachhead for full PLC compromise.

Why This Matters for a Real Plant

A compromised PLC is not just a cyber problem. It means being able to:

• Manipulate the industrial process, altering setpoints, logic, and actuators.
• Modify system configurations persistently.
• Interrupt or damage portions of critical infrastructure.
• Introduce physical safety risks for personnel.

This is exactly the kind of scenario that the growing IT/OT convergence makes more likely: devices once isolated are now reachable from broader networks, and a poorly protected service account may be enough to trigger the chain.

Mitigations

WAGO has released updated firmware (version 28 and later) that resolves the flaws. The first action is therefore to update affected devices. This should be accompanied by established best practices: strong authentication, network segmentation, least-privilege enforcement, and periodic security assessments.

The MON5 Perspective

Applying a patch to a PLC, however, is not as simple as on a server: it often requires a plant downtime window that is not always available. This is why visibility becomes the prerequisite for any decision. Without an accurate OT asset inventory, it is impossible to know how many 750-8216 units are deployed in the field, with what firmware, and with what network exposure.

MON5 addresses exactly this problem: it maps industrial assets passively, correlates known vulnerabilities with real plant context (model, version, network position) to establish a sensible intervention priority, and monitors behavioral anomalies without interfering with production. Even when a patch cannot be applied immediately, recognizing in time an attempt to disable authentication or an anomalous file write on a controller is what turns a potential incident into a manageable alert.

Analysis and commentary by MON5 based on publicly available OT/ICS sector research and data.