CVE-2025-41753
0751-9x01: Path traversal in dynamically created BACnet File Objects
WAGO 0751-9x01Industrial & IoT
CVSS
9.3CriticalExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.59%Chance of exploitation activity in the next 30 days, higher than 47% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 4.8.90751-9x01CVE List
- 4.8.90750-811x-xxxx-xxxxCVE List
- 4.8.90750-821x-xxx-xxxCVE List
- 4.8.90762-420x-8000-000xCVE List
- 4.8.90762-430x-8000-000xCVE List
- 4.8.90762-520x-8000-000xCVE List
Show all 22 fixed versions
- 4.8.90762-530x-8000-000xCVE List
- 4.8.90762-620x-8000-000xCVE List
- 4.8.90762-630x-8000-000xCVE List
- 4.8.90752-8303-8000-0002CVE List
- 4.8.90762-340xCVE List
- 4.8.9 (70)0751-9x01CVE List
- 4.8.9 (70)0750-811x-xxxx-xxxxCVE List
- 4.8.9 (70)0750-821x-xxx-xxxCVE List
- 4.8.9 (70)0762-420x-8000-000xCVE List
- 4.8.9 (70)0762-430x-8000-000xCVE List
- 4.8.9 (70)0762-520x-8000-000xCVE List
- 4.8.9 (70)0762-530x-8000-000xCVE List
- 4.8.9 (70)0762-620x-8000-000xCVE List
- 4.8.9 (70)0762-630x-8000-000xCVE List
- 4.8.9 (70)0752-8303-8000-0002CVE List
- 4.8.9 (70)0762-340xCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation. Because relative paths are not limited to the intended directory, an unauthenticated remote attacker can traverse outside of it and read or overwrite arbitrary files on the device, which may lead to full system compromise.
Text from CVE List
Affected versions 22
- 0751-9x01affected: 1.0.0 before 4.8.9CVE List
- 0750-811x-xxxx-xxxxaffected: 1.0.0 before 4.8.9CVE List
- 0750-821x-xxx-xxxaffected: 1.0.0 before 4.8.9CVE List
- 0762-420x-8000-000xaffected: 1.0.0 before 4.8.9CVE List
- 0762-430x-8000-000xaffected: 1.0.0 before 4.8.9CVE List
- 0762-520x-8000-000xaffected: 1.0.0 before 4.8.9CVE List
- 0762-530x-8000-000xaffected: 1.0.0 before 4.8.9CVE List
- 0762-620x-8000-000xaffected: 1.0.0 before 4.8.9CVE List
- 0762-630x-8000-000xaffected: 1.0.0 before 4.8.9CVE List
- 0752-8303-8000-0002affected: 1.0.0 before 4.8.9CVE List
- 0762-340xaffected: 1.0.0 before 4.8.9CVE List
- 0751-9x01affected: 1.0.0 before 4.8.9 (70)CVE List
- 0750-811x-xxxx-xxxxaffected: 1.0.0 before 4.8.9 (70)CVE List
- 0750-821x-xxx-xxxaffected: 1.0.0 before 4.8.9 (70)CVE List
- 0762-420x-8000-000xaffected: 1.0.0 before 4.8.9 (70)CVE List
- 0762-430x-8000-000xaffected: 1.0.0 before 4.8.9 (70)CVE List
- 0762-520x-8000-000xaffected: 1.0.0 before 4.8.9 (70)CVE List
- 0762-530x-8000-000xaffected: 1.0.0 before 4.8.9 (70)CVE List
- 0762-620x-8000-000xaffected: 1.0.0 before 4.8.9 (70)CVE List
- 0762-630x-8000-000xaffected: 1.0.0 before 4.8.9 (70)CVE List
- 0752-8303-8000-0002affected: 1.0.0 before 4.8.9 (70)CVE List
- 0762-340xaffected: 1.0.0 before 4.8.9 (70)CVE List