Certain devices in the WAGO System I/O Field series activate an internal diagnostic capability during the…

CVE-2026-4769 is a CWE-912 Hidden Functionality issue in select WAGO System I/O Field modules — the ruggedized field-mounted I/O devices that sit directly on the production network wiring back to PLCs, DCS heads, and SCADA gateways. Per the vendor advisory (2026-07-13), during the initial startup sequence the device activates an *internal diagnostic capability*. Combined with the vendor's own CVSS vector (AV:N/AC:L/PR:N/UI:N), that means the diagnostic interface is reachable over the network from an unauthenticated adjacent host at every power-cycle — and in most OT sites, power cycles happen on maintenance windows, cold starts, and outage recovery, exactly when the plant is most fragile. Affected version ranges are not fully enumerated in the public feed yet; treat *all currently-shipping WAGO System I/O Field firmware* as suspect until WAGO's PSIRT bulletin (VDE-CERT) lists specific FW cutoffs.

The vendor's 9.8 CRITICAL rating is fair and we are not downgrading it. This is a *backdoor-class* weakness (CWE-912 is literally the 'hidden functionality / backdoor' category) on a component whose *canonical deployment role* is inside an OT cell — the exact class my ruleset floors at CRITICAL. The only reason we don't score higher than 9.4 is the practical reality that most WAGO field gear lives behind a Purdue L2/L3 boundary, so the exploitable population from the public internet is small. That's not immunity; that's a delayed timer.

Why this verdict

• Role multiplier — OT field controller: the affected component is by definition an ICS/SCADA-adjacent I/O device; per noisgate policy, backdoor-class flaws in OT hardware are floored CRITICAL because the blast radius is process/safety impact, not just data
• Backdoor semantics: CWE-912 is qualitatively worse than a typical memory-corruption CVE — it's *intended* code paths that shouldn't exist, meaning no memory-safety mitigation (ASLR, DEP, stack canaries) helps
• Unauthenticated network vector confirmed by vendor CVSS — no credential, no user interaction, no local access required within the reachable segment
• Downward pressure — segmentation reality: most WAGO field gear lives in Purdue L2, not on the internet, so raw exposed population is modest; this is why the score sits at 9.4 not 9.8
• Downward pressure — boot-window timing: exploit requires the diagnostic to be active, likely only during startup; adversary must race or induce reboot

Why not higher?

We shaved 0.4 off the vendor 9.8 because the diagnostic is time-boxed to boot and the reachable population is constrained by standard OT segmentation. Without those two frictions we would agree with 9.8 exactly.

Why not lower?

This cannot be a HIGH. It's a backdoor-class flaw in an OT field device — the noisgate role-multiplier rule explicitly floors this at CRITICAL when the affected component is canonically an ICS controller, and 'requires internal access' does NOT break the floor without published installed-base evidence showing <1% of units are reachable, which we do not have.

1. Enforce strict ISA/IEC 62443 zone & conduit segmentation around WAGO I/O Field devices — The exploit requires network reachability during boot. Ensure only whitelisted engineering workstations and PLCs on the same cell can talk to the I/O module — everything else drops at the OT firewall. Deploy within 3 days per the noisgate CRITICAL mitigation SLA.
2. Enable passive DPI monitoring on OT taps — Point Nozomi Guardian, Claroty CTD, or Dragos at the affected cell's SPAN port and build a detection for unknown protocol handshakes to WAGO endpoints during boot windows. Within 3 days.
3. Restrict and log all reboot / power-cycle events on affected devices — Since exploitation requires catching the boot window, any unscheduled reboot is a high-fidelity IOC. Wire device power state into the SIEM. Within 3 days.
4. Inventory: identify every WAGO System I/O Field module by part number and firmware — You cannot patch what you don't know you have. Pull from the CMDB, asset-inventory tool (Armis, Claroty xDome), and physical walkdowns. Within the 3-day mitigation window.
5. Coordinate with WAGO PSIRT / CERT@VDE for firmware — Register for the advisory update stream so you receive fixed firmware notification immediately. Plan the patch drop into the next planned maintenance window inside the 90-day noisgate remediation SLA.

Run this from the auditor workstation or a monitoring host on the OT engineering VLAN with read-only network reach to the WAGO device. It performs a *passive banner check* only — no fuzzing, no writes. Invoke as python3 check_wago_4769.py 10.20.30.40 where the argument is the target IP. Requires Python 3.8+ and permission to open TCP sockets on that VLAN.

#!/usr/bin/env python3
# noisgate verifier for CVE-2026-4769 (WAGO System I/O Field diagnostic exposure)
# READ-ONLY: performs TCP connect + banner grab only. Does NOT send exploit traffic.
# Exit codes: 0 = PATCHED / not exposed, 1 = VULNERABLE (diagnostic reachable), 2 = UNKNOWN

import socket
import sys
import ssl

# Ports historically associated with WAGO diagnostic / management interfaces.
# Adjust once WAGO PSIRT publishes the exact diagnostic port for CVE-2026-4769.
CANDIDATE_PORTS = [80, 443, 2455, 6626, 11740, 44818]
TIMEOUT = 3.0


def probe(host: str, port: int) -> str:
    try:
        with socket.create_connection((host, port), timeout=TIMEOUT) as s:
            s.settimeout(TIMEOUT)
            try:
                banner = s.recv(256)
                return banner.decode(errors="replace").strip()
            except socket.timeout:
                return "<open-no-banner>"
    except (socket.timeout, ConnectionRefusedError, OSError):
        return ""


def main() -> int:
    if len(sys.argv) != 2:
        print("usage: check_wago_4769.py <target-ip>", file=sys.stderr)
        return 2

    host = sys.argv[1]
    hits = []
    for p in CANDIDATE_PORTS:
        b = probe(host, p)
        if b:
            hits.append((p, b))

    if not hits:
        # No management/diagnostic surface reachable => not exposed from this vantage
        print(f"PATCHED  {host}  no diagnostic listener reachable from this segment")
        return 0

    diag_markers = ("WAGO", "diag", "IO-Field", "boot")
    vulnerable = any(
        any(m.lower() in banner.lower() for m in diag_markers)
        for _, banner in hits
    )

    for port, banner in hits:
        print(f"  :{port}  banner={banner[:80]!r}")

    if vulnerable:
        print(f"VULNERABLE  {host}  diagnostic-class banner observed — confirm firmware")
        return 1

    print(f"UNKNOWN  {host}  listener present but no diagnostic marker; correlate with WAGO PSIRT bulletin")
    return 2


if __name__ == "__main__":
    sys.exit(main())

Sources

1. WAGO I/O System Field product page
2. CERT@VDE advisory portal
3. CWE-912: Hidden Functionality
4. CISA ICS Advisory — WAGO Managed Switches
5. Nozomi Networks — Vulnerabilities in WAGO PLCs
6. OffSeq Threat Radar — CVE-2026-3587 (related WAGO CWE-912)
7. CISA Known Exploited Vulnerabilities Catalog
8. WAGO Download Center (firmware release notes)