WAGO SBOM: getting controllers, couplers and K-bus modules into the device list

What hangs on a WAGO controller and what of it is visible on the network

A WAGO node is a controller (PFC100, PFC200, CC100) or a fieldbus coupler with up to 64 I/O modules of the 750 series on the terminal bus. The modules are not network participants; the controller or coupler speaks for them. Added to this are managed switches, touch panels and, in mixed plants, WAGO couplers on a third-party controller.

• Visible via IP from the maintenance PC: controllers and couplers via SNMP (sysDescr names order number, hardware and firmware version, sysObjectID under IANA 13576), PROFINET couplers additionally via DCP/I&M0, EtherNet/IP couplers via the Identity Object; switches via SNMP, panels via web identification.
• Only via the controller or coupler: all I/O modules on the terminal bus. A PROFINET coupler reports the modules as submodules per slot, then I&M0 per slot provides the order number; with controllers and other couplers, only the head knows the module list.
• Only from the engineering: simple digital and analog modules without firmware. They are in the bill of materials, not in the plant SBOM.

How the terminal bus modules get into the list: WAGO-I/O-CHECK, CODESYS project, Web-Based Management

WAGO-I/O-CHECK reads the terminal bus of a node and lists every module with order number; the CODESYS project (from firmware release 23, previously e!COCKPIT) keeps the same list as the planned state; the controller's Web-Based Management shows firmware release and order number of the head. With PROFINET couplers the scan reads the modules directly as submodules with I&M0. From the network, the following are added:

• Engineering: e!COCKPIT is discontinued (end of support 31 Mar 2025), its successor is CODESYS V3.5 from firmware release 23. The project carries controllers and couplers with order number; the firmware release is on the device.
• Network: PFC100/200 and CC100 answer via SNMP (sysDescr, sysObjectID under IANA number 13576), through the web-based management interface and, depending on the variant, via PROFINET DCP/I&M0 (750-37x couplers, PN variants) or the EtherNet/IP Identity Object. Which query reaches which devices is explained in the article on the network scan.
• Firmware release as a number (FW30, FW32), because the advisories use both notations – semantic version and release number.

How WAGO publishes advisories and what matching runs on

The PSIRT page refers to CERT@VDE for all advisories; there is no provider of its own under wago.com (.well-known/csaf redirects to the home page). The CERT@VDE provider offers ROLIE feed, index.txt and changes.csv and is cleared for mirroring on aggregators – yet WAGO was not listed in the BSI aggregator on the measurement day.

Example VDE-2025-081: "CC100 0751-9x01" becomes model_numbers: ["0751-9?01"], "PFC200 G2 750-821x-xxx-xxx" becomes 750-821?-????-????, the firmware a range >=1.0.0 | <4.10.0 with the addition "FW32". CPE appears only on the wago_os_linux branch, never on the hardware.

The placeholder scheme is an advantage for matching if the tool understands it: 750-821?-????-???? hits every PFC200 G2 variant, whatever connection or equipment variant is in the field. A tool that only compares order numbers exactly, on the other hand, misses almost every WAGO advisory. Anyone searching by CPE finds only the ten documents with operating system CPE – and matches them to no device, because the hardware carries no CPE. More on this pattern in the article on tool selection.

43 of the 82 documents carry an update stamp from 2025: WAGO brought the archive up to date in one burst. Anyone filtering only on "new" does not see such re-releases.

We did not find an SBOM per product at WAGO; for the plant you do not need one, the advisories name order number and release.

What this means for installations with WAGO components

• Record the full order number (with variant suffix) and the firmware release per WAGO controller and coupler.
• Design matching for placeholder patterns – exact comparisons do not hit at WAGO.
• Carry managed switches (852-xxxx) and touch panels (762-xxxx) as items of their own; 2026 brought advisories for both.

A tool that compares order numbers only exactly misses almost every WAGO advisory, and the module list behind the controller exists only in the head of the node. In Werkspilot Scan, WAGO is stages 1 to 3: controllers, couplers and switches come via SNMP and I&M0 in one run from the maintenance PC, modules behind PROFINET couplers as submodules right away, the modules behind controllers after enabling via the node. We are currently trialling the third stage with development partners on their plants.