An authenticated remote attacker with high privileges can modify the OpenVPN configuration through the web‑based management interface on certain WAGO PLCs. When the system allows user‑defined scripts, OpenVPN can be abused to inject and execute arbitrary shell commands, providing the attacker full remote code execution on the device. The weakness originates from improper validation of configuration input (CWE‑94).

Vulnerable models include WAGO CC100 (0751‑9x01), Edge Controller (0752‑8303‑8000‑0002), PFC100 G1 (0750‑810‑xxxx‑xxxx), PFC100 G2 (0750‑811x‑xxxx‑xxxx), PFC200 G1 (750‑820x‑xxxx‑xxxx), PFC200 G2 (750‑821x‑xxxx‑xxxx), TP600 series (0762‑420x, 430x, 520x, 530x, 620x, 630x with 8000‑000x), and WP400 (0762‑340x).

CVSS score 7.2 denotes a high severity vulnerability; exploitation requires authentication and high‑privilege access but leverages the public web interface, making it network‑exposed. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. If configuration changes are made to permit user‑defined scripts, the attacker can run arbitrary shell commands, compromising confidentiality, integrity, and availability of the device. Mitigation includes applying vendor patches, restricting management interface access, and disabling script execution.