Summary
Critical vulnerabilities in the PHP runtime may allow a remote attacker to execute arbitrary code by exploiting weaknesses in PHP's internal memory and request handling mechanisms. Under specific conditions, specially crafted web requests can trigger unexpected behavior that could compromise the affected web server process. WAGO controllers with the integrated web server enabled and running an affected PHP version are exposed to these vulnerabilities.
Impact
Successful exploitation could allow an attacker to gain control over the affected PHP process through the web interface, potentially leading to unauthorized access, manipulation of application data, or disruption of device functionality.
Affected Product(s)
| Model no. | Product name | Affected versions |
|---|---|---|
| 0751-9?0? | CC100 | wago_os_linux <4.10.4 (FW32) |
| 0752-8303-8000-0002 | Edge Controller | wago_os_linux <4.10.4 (FW32) |
| 0750-811?-????-???? | PFC100 G2 | wago_os_linux <4.10.4 (FW32) |
| 0750-821?-???-??? | PFC200 G2 | wago_os_linux <4.10.4 (FW32) |
| 0750-8302 | PFC300 | wago_os_linux <4.10.4 (FW32) |
| 0762-420?-8000-000?, 0762-430?-8000-000?, 0762-520?-8000-000?, 0762-530?-8000-000?, 0762-620?-8000-000?, 0762-630?-8000-000? | TP600 | wago_os_linux <4.10.4 (FW32) |
| 0762-340? | WP400 | wago_os_linux <4.10.4 (FW32) |
Vulnerabilities
Expand / Collapse allPHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
Mitigation
To mitigate these vulnerabilities, disable the device's web server through the security settings. This prevents the vulnerabilities from being exploited via the web interface until a security update or patch has been applied.
Remediation
Update the device to Firmware Version 4.10.4 (FW32) or later. Until FW32 is available, customers using Firmware Version 4.9.1 (FW31) should install the corresponding IPK security patch, which is available through the WAGO Download Center.
Acknowledgments
WAGO GmbH & Co. KG thanks the following parties for their efforts:
- CERT@VDE for coordination (see https://certvde.com )
Revision History
| Version | Date | Summary |
|---|---|---|
| 1.0.0 | 02.11.2026 12:00 | Release version. |