CVE-2024-1490
Full vulnerability record from the local CVENow database.
Description
An authenticated remote attacker with high privileges can exploit the OpenVPN configuration via the web-based management interface of a WAGO PLC. If user-defined scripts are permitted, OpenVPN may allow the execution of arbitrary shell commands enabling the attacker to run arbitrary commands on the device.
Severity
HIGH
CVSS score
7.2
(v3.1)
Vulnerability status
Awaiting Analysis
Source identifier
Published
2026-04-09 11:16:19.657000
Last modified
2026-11-08 20:10:00.187000
View original CVE JSON
{
"id": "CVE-2024-1490",
"sourceIdentifier": "[email protected]",
"published": "2026-04-09T11:16:19.657",
"lastModified": "2026-11-08T20:10:00.187",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An authenticated remote attacker with high privileges can exploit the OpenVPN configuration via the web-based management interface of a WAGO PLC. If user-defined scripts are permitted, OpenVPN may allow the execution of arbitrary shell commands enabling the attacker to run arbitrary commands on the device."
},
{
"lang": "es",
"value": "Un atacante remoto autenticado con privilegios elevados puede explotar la configuración de OpenVPN a través de la interfaz de gestión basada en web de un PLC WAGO. Si se permiten scripts definidos por el usuario, OpenVPN podría permitir la ejecución de comandos de shell arbitrarios, lo que permite al atacante ejecutar comandos arbitrarios en el dispositivo."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "WAGO",
"product": "CC100 (0751-9x01)",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0.0.0",
"lessThanOrEqual": "4.5.10",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "WAGO",
"product": "PFC100 G1 (0750-810-xxxx-xxxx)",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0.0.0",
"lessThanOrEqual": "3.10.10",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "WAGO",
"product": "PFC100 G2 (0750-811x-xxxx-xxxx)",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0.0.0",
"lessThanOrEqual": "4.5.10",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "WAGO",
"product": "PFC200 G1 (750-820x-xxxx-xxxx)",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0.0.0",
"lessThanOrEqual": "3.10.10",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "WAGO",
"product": "PFC200 G2 (750-821x-xxxx-xxxx)",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0.0.0",
"lessThanOrEqual": "4.5.10",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "WAGO",
"product": "TP600 (0762-420x-8000-000x)",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0.0.0",
"lessThanOrEqual": "FW 26",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "WAGO",
"product": "TP600 (0762-430x-8000-000x)",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0.0.0",
"lessThanOrEqual": "4.5.10",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "WAGO",
"product": "TP600 (0762-520x-8000-000x)",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0.0.0",
"lessThanOrEqual": "4.5.10",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "WAGO",
"product": "TP600 (0762-530x-8000-000x)",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0.0.0",
"lessThanOrEqual": "4.5.10",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "WAGO",
"product": "TP600 (0762-620x-8000-000x)",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0.0.0",
"status": "affected"
}
]
},
{
"vendor": "WAGO",
"product": "TP600 (0762-630x-8000-000x)",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0.0.0",
"lessThanOrEqual": "4.5.10",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "WAGO",
"product": "Edge Controller (0752-8303-8000-0002)",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0.0.0",
"lessThanOrEqual": "4.5.10",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "WAGO",
"product": "WP400 (0762-340x)",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0.0.0",
"lessThanOrEqual": "4.5.10",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-04-09T14:27:36.814209Z",
"id": "CVE-2024-1490",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-94"
}
]
}
],
"references": [
{
"url": "https://certvde.com/de/advisories/VDE-2024-008",
"source": "[email protected]"
},
{
"url": "https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2024-008.json",
"source": "[email protected]"
}
]
}