External risk intelligence

WAGO System I/O Field Startup Vulnerability Allows Unauthenticated Remote System Compromise.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-4769

The affected WAGO System I/O Field devices are industrial automation components typically deployed within isolated operational technology or private control networks. While network-reachable in some environments, public internet exposure is uncommon as these devices are generally protected by internal network controls and are not intended to be exposed directly to the public internet.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability has been identified in certain WAGO System I/O Field devices that allows unauthenticated remote attackers to gain full system compromise during the initial startup sequence. This is due to an undocumented diagnostic capability that is accessible for a short period without requiring credentials.

Undocumented feature grants system access.
Critical vulnerability affects industrial control systems.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could gain control of certain WAGO devices by exploiting an undocumented diagnostic feature that is briefly accessible during the device's startup. If an attacker can reach the device over the network, they can leverage this window of opportunity before it's secured to access internal system processes and achieve a full compromise.

Device is network-accessible.
Exploits undocumented startup feature.
Leads to full system compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated remote attacker to compromise the entire system by accessing internal diagnostic capabilities during the initial startup sequence of certain WAGO System I/O Field devices. This access is available for a short window before formal authentication is required.

System processes are at risk.
Unauthenticated remote access can occur.
Full system compromise is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in WAGO System I/O Field devices requires an immediate response, likely involving asset owners and infrastructure teams. The first critical step is to identify all instances of this technology, determine their business criticality and network exposure, and confirm the responsible system owner for remediation planning.

Identify responsible system owners.
Verify device reachability and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the WAGO System I/O Field series?

These are industrial automation components used to manage and control complex processes in environments like manufacturing or energy utilities. They act as essential bridge hardware, connecting physical sensors and machinery to control networks, allowing automated systems to process data and perform operational tasks.

What does CVE-2026-4769 mean?

This vulnerability, classified as CWE-912, involves an undocumented diagnostic feature that remains active for a short time when the device boots up. Because this function does not require any credentials, it acts like an unintended back door that can grant unauthorized users full control over the device's internal system processes during that critical startup window.

When does this vulnerability trigger?

The risk is present exclusively during the device's initial startup sequence. If a device has already completed its boot process and is running in its normal operational state, this specific diagnostic pathway is no longer active. The risk is limited to the brief duration when the hardware is first initializing before standard security protections engage.

How relevant is this to my network?

According to Halo Surface Signal, these devices are typically housed within isolated operational technology or private control networks. While the vulnerability is technically reachable over a network, direct exposure to the public internet is considered unlikely for this type of equipment, as they are usually shielded by internal network security controls.

What should I do if I use these devices?

Your first step is to perform an inventory to locate all deployed instances within your environment. Once identified, work with your infrastructure teams to confirm the business criticality of these devices and assess their specific network reachability. This information will help you prioritize remediation and define a plan to secure these assets according to your organization's risk management policies.

References

www.certvde.com/en/advisories/VDE-2026-031/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.