WAGO: Vulnerability in managed switches
A vulnerability has been found affecting the Managed Switches of WAGO. An unauthenticated attacker can fully compromise the device via an undocumented function.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-3587US | — | — | ||
An unauthenticated remote attacker can exploit a hidden function in the CLI prompt to escape the restricted interface, leading to full compromise of the device. | ||||
references
External citations — patches, advisories, analysis.
remediations (17)
- Fixed
Please update your devices to the specified fixed firmware version. | Product | Fixed Version | |-------------------------------------------|---------------| | Lean Managed Switch 852-1812 | V1.2.1.S1 | | Lean Managed Switch 852-1813 | V1.2.1.S1 | | Lean Managed Switch 852-1813/000-001| V1.2.3.S1 | | Lean Managed Switch 852-1816 | V1.2.1.S1 | | Industrial Managed Switch 852-303 | V1.2.8.S1 | | Industrial Managed Switch 852-1305 | V1.2.0.S1 | | Industrial Managed Switch 852-1305/000-001| V1.2.0.S1 | | Industrial Managed Switch 852-1505/000-001| V1.2.0.S1 | | Industrial Managed Switch 852-1505 | V1.1.9.S1 | | Industrial Managed Switch 852-602 | V1.0.6.S1 | | Industrial Managed Switch 852-603 | V1.0.6.S1 | | Industrial Managed Switch 852-1605 | V1.2.5.S1 | | Lean Managed Switch 852-1812/010-000| V1.2.1.S1 | | Lean Managed Switch 852-1813/010-000| V1.2.1.S1 | | Lean Managed Switch 852-1813/010-001| V1.2.1.S1 | | Lean Managed Switch 852-1816/010-000| V1.2.1.S1 |
- Workaround852-1305
To reduce the attack vector deactivate ssh and telnet on the devices. This ensures that the CLI is only accessible locally via RS232.
- Workaround852-1305/000-001
To reduce the attack vector deactivate ssh and telnet on the devices. This ensures that the CLI is only accessible locally via RS232.
- Workaround852-1505
To reduce the attack vector deactivate ssh and telnet on the devices. This ensures that the CLI is only accessible locally via RS232.
- Workaround852-1505/000-001
To reduce the attack vector deactivate ssh and telnet on the devices. This ensures that the CLI is only accessible locally via RS232.
- Workaround852-1605
To reduce the attack vector deactivate ssh and telnet on the devices. This ensures that the CLI is only accessible locally via RS232.
- Workaround852-1812
To eliminate the attack vector deactivate ssh and telnet on the device.
- Workaround852-1812/010-000
To eliminate the attack vector deactivate ssh and telnet on the device.
- Workaround852-1813
To eliminate the attack vector deactivate ssh and telnet on the device.
- Workaround852-1813/000-001
To eliminate the attack vector deactivate ssh and telnet on the device.
- Workaround852-1813/010-000
To eliminate the attack vector deactivate ssh and telnet on the device.
- Workaround852-1813/010-001
To eliminate the attack vector deactivate ssh and telnet on the device.
- Workaround852-1816
To eliminate the attack vector deactivate ssh and telnet on the device.
- Workaround852-1816/010-000
To eliminate the attack vector deactivate ssh and telnet on the device.
- Workaround852-303
To reduce the attack vector deactivate ssh and telnet on the devices. This ensures that the CLI is only accessible locally via RS232.
- Workaround852-602
To reduce the attack vector deactivate ssh and telnet on the devices. This ensures that the CLI is only accessible locally via RS232.
- Workaround852-603
To reduce the attack vector deactivate ssh and telnet on the devices. This ensures that the CLI is only accessible locally via RS232.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan