WAGO Web-Based Management Default Login Scanner

WAGO Web-Based Management is a web interface used to configure and monitor WAGO programmable logic controllers (PLCs) and automation systems. It is widely deployed in manufacturing plants, process industries, and commercial building automation. System integrators, engineers, and IT professionals rely on it for real-time system management, diagnostics, and firmware updates.

The vulnerability arises when default credentials (e.g., admin/admin) are left unchanged after initial setup. This common oversight allows attackers to bypass authentication and gain unauthorized access to the management interface. The issue is exacerbated by the fact that many OT environments lack regular security audits, leaving default credentials in place for years.

This scanner specifically targets the login endpoint of WAGO Web-Based Management, typically found at /login or /admin. It tests a list of known default username and password pairs against the interface. If any pair succeeds, the scanner flags the asset as vulnerable, indicating that the interface is accessible with default credentials.

Exploitation of this vulnerability can lead to full control over the WAGO PLC, allowing attackers to modify control logic, disrupt production processes, or exfiltrate sensitive data. In critical infrastructure environments, this could cause operational downtime, safety hazards, or even physical damage. Immediate remediation is essential to protect OT assets.