CVE-2026-4769CWE-912

Unauthenticated Access to Internal Diagnostic Interface

Critical · published July 13, 2026

CVSS v4.0
9.3
EPSS
1%
Percentile
54.7
In the wild
Unconfirmed
What it is

Certain devices in the WAGO System I/O Field series activate an internal diagnostic capability during the initial startup sequence. This functionality is not formally documented and becomes accessible without authentication for a brief period in the early boot phase. During this window, an unauthenticated remote attacker can gain access to the internal system processes, resulting in full system compromise.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00757 · 54.7th percentile
Weakness
CWE-912 · Hidden Functionality
Published
2026-07-13T06:35Z
EPSS history
Timeline
  • 13 JUL 06:35Z
    Unauthenticated Access to Internal Diagnostic Interface
    cvelistv5