The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation. Because relative paths are not limited to the intended directory, an unauthenticated remote attacker can traverse outside of it and read or overwrite arbitrary files on the device, which may lead to full system compromise.
Critical 9.8
CVE-2025-41753
WAGO 0751-9x01 — path traversal.
The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation.
WeaknessCWE-22: Path traversal
Published Updated Source NVD
CVSS 3.1
9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploit chance, 30 days
0.6%
Higher than 48% of all CVEs (EPSS)
Status
No known exploitation
Not in CISA KEV
Patch
Unknown
Check the vendor advisory
What happened
What to do
- 01Check whether you run WAGO 0751-9x01, and which version.
- 02Follow the vendor advisory for a fix or a workaround.
References
Timeline · UTC
- Published to NVD
- NVD record updated
Also actively exploited