CVE-2025-252646.5MediumCWE-942

CVE-2025-25264: Overly Permissive CORS Policy in WAGO Device Manager

WAGO · CC100 0751-9x01

Vendor fix available · Affected: WAGO CC100 0751-9x01 · Exploitation: unlikely (under 1%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

0.4%probability of exploitation in the next 30 days

38th percentile

050100

Higher than 38% of scored CVEs

6.5MediumCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

An unauthenticated remote attacker can trick an admin to visit a website containing malicious java script code. The current overly permissive CORS policy allows the attacker to obtain any files from the file system.

Affected products20

From the CVE record. A product or version that is not listed is unknown, not unaffected.

WAGO · CC100 0751-9x01from 0.0.0 before 04.07.01 (FW29)
WAGO · CC100 0751-9x01from 0.0.0 before 04.07.01 (70
WAGO · PFC100 G1 0750-810x/xxxx-xxxxfrom 0.0.0 before 3.10.11 (FW22 Patch 2)
WAGO · PFC100 G2 0750-811x-xxxx-xxxxfrom 0.0.0 before 04.07.01 (70)
WAGO · PFC200 G1 750-820x-xxx-xxxfrom 0.0.0 before 3.10.11 (FW22 Patch 2)
WAGO · PFC200 G2 750-821x-xxx-xxxfrom 0.0.0 before 04.07.01 (FW29)
WAGO · PFC200 G2 750-821x-xxx-xxxfrom 0.0.0 before 04.07.01 (70)
WAGO · TP600 0762-420x/8000-000xfrom 0.0.0 before 04.07.01 (FW29)
WAGO · TP600 0762-420x/8000-000xfrom 0.0.0 before 04.07.01 (70)
WAGO · TP600 0762-430x/8000-000xfrom 0.0.0 before 04.07.01 (FW29)
WAGO · TP600 0762-430x/8000-000xfrom 0.0.0 before 04.07.01 (70)
WAGO · TP600 0762-520x/8000-000xfrom 0.0.0 before 04.07.01 (FW29)
WAGO · TP600 0762-520x/8000-000xfrom 0.0.0 before 04.07.01 (70)
WAGO · TP600 0762-530x/8000-000xfrom 0.0.0 before 04.07.01 (FW29)
WAGO · TP600 0762-530x/8000-000xfrom 0.0.0 before 04.07.01 (70)
WAGO · TP600 0762-620x/8000-000xfrom 0.0.0 before 04.07.01 (FW29)
WAGO · TP600 0762-620x/8000-000xfrom 0.0.0 before 04.07.01 (70)
WAGO · TP600 0762-630x/8000-000xfrom 0.0.0 before 04.07.01 (FW29)
WAGO · TP600 0762-630x/8000-000xfrom 0.0.0 before 04.07.01 (70)
WAGO · Edge Controller 0752-8303/8000-0002from 0.0.0 before 04.07.01 (FW29)

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Permissive Cross-domain Security Policy with Untrusted Domains · Misconfiguration and Insecure Design
Vendor: WAGO
Published: June 2025
Band: Unlikely (under 1%), June 2025

CoverageNo articles yet

No CyberSIXT article names CVE-2025-25264 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.