CVE-2025-41715 (CVSS 9.8): Unauthenticated Flaw Exposes WAGO Industrial Databases

CVE-2025-41715 (CVSS 9.8) is an unauthenticated flaw in WAGO Device Sphere and WAGO Solution Builder that could expose databases and enable targeted attacks if left unpatched, according to VDE CERT advisory. The vulnerability stems from a missing authentication check, with researchers warning that the web application database is exposed, allowing an unauthenticated remote attacker to gain unauthorized access.

Such access could let attackers read, manipulate, or delete records, potentially resulting in data loss, theft, or full application compromise. A second flaw, CVE-2025-41716 (CVSS 5.3), enables unauthenticated attackers to enumerate users and their roles, aiding brute-force or social engineering campaigns aimed at privileged accounts. VDE CERT advises users to update to the latest versions: WAGO Device Sphere to 1.1.0 or later and WAGO Solution Builder to 2.3.3 or later. Organisations running earlier versions remain vulnerable and should prioritise patching as part of security maintenance, according to advisory.