Wago 750 Series PLCs with firmware version 10 and prior...

5.3 CVSS

Vulnerability Description

Wago 750 Series PLCs with firmware version 10 and prior include a remote attack may take advantage of an improper implementation of the 3 way handshake during a TCP connection affecting the communications with commission and service tools. Specially crafted packets may also be sent to Port 2455/TCP/IP, used in Codesys management software, which may result in a denial-of-service condition of communications with commissioning and service tools.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-8836

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from WAGO

View All →

CVE-2025-41732

Stack-based buffer overflow via unsafe sscanf in check_cookie()

Critical 9.8

CVE-2025-41730

Stack-based buffer overflow via unsafe sscanf in check_account()

Critical 9.8

CVE-2025-41716

Unauthenticated User Enumeration via Missing Authentication

Medium 5.3

CVE-2025-41715

Missing Authentication for Database Access in Web Application

Critical 9.8

CVE-2025-41713

WAGO: Vulnerability in hardware switch circuit

Medium 6.5

Affected Vendor

WAGO

View all reports →

Affected Software

WAGO 750 Series

Vulnerable Versions:

750-880 firmware version 10 and prior, 750-881 firmware version 10 and prior, 750-852 firmware version 10 and prior, 750-882 firmware version 10 and prior, 750-885 firmware version 10 and prior, 750-831 firmware version 10 and prior, 750-889 firmware version 10 and prior, 750-829 firmware version 10 and prior