CVE-2026-3587
criticalEPSS 0.006 · 50 %ileDEEUUSEPSS · scored 2026-10-17
An unauthenticated remote attacker can exploit a hidden function in the CLI prompt to escape the restricted interface, leading to full compromise of the device.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- Fixedwago_psirt
Please update your devices to the specified fixed firmware version. | Product | Fixed Version | |-------------------------------------------|---------------| | Lean Managed Switch 852-1812 | V1.2.1.S1 | | Lean Managed Switch 852-1813 | V1.2.1.S1 | | Lean Managed Switch 852-1813/000-001| V1.2.3.S1 | | Lean Managed Switch 852-1816 | V1.2.1.S1 | | Industrial Managed Switch 852-303 | V1.2.8.S1 | | Industrial Managed Switch 852-1305 | V1.2.0.S1 | | Industrial Managed Switch 852-1305/000-001| V1.2.0.S1 | | Industrial Managed Switch 852-1505/000-001| V1.2.0.S1 | | Industrial Managed Switch 852-1505 | V1.1.9.S1 | | Industrial Managed Switch 852-602 | V1.0.6.S1 | | Industrial Managed Switch 852-603 | V1.0.6.S1 | | Industrial Managed Switch 852-1605 | V1.2.5.S1 | | Lean Managed Switch 852-1812/010-000| V1.2.1.S1 | | Lean Managed Switch 852-1813/010-000| V1.2.1.S1 | | Lean Managed Switch 852-1813/010-001| V1.2.1.S1 | | Lean Managed Switch 852-1816/010-000| V1.2.1.S1 |
- WorkaroundIndustrial Managed Switch 852-1305wago_psirt
To reduce the attack vector deactivate ssh and telnet on the devices. This ensures that the CLI is only accessible locally via RS232.
- WorkaroundIndustrial Managed Switch 852-1305/000-001wago_psirt
To reduce the attack vector deactivate ssh and telnet on the devices. This ensures that the CLI is only accessible locally via RS232.
- WorkaroundIndustrial Managed Switch 852-1505wago_psirt
To reduce the attack vector deactivate ssh and telnet on the devices. This ensures that the CLI is only accessible locally via RS232.
- WorkaroundIndustrial Managed Switch 852-1505/000-001wago_psirt
To reduce the attack vector deactivate ssh and telnet on the devices. This ensures that the CLI is only accessible locally via RS232.
- WorkaroundIndustrial Managed Switch 852-1605wago_psirt
To reduce the attack vector deactivate ssh and telnet on the devices. This ensures that the CLI is only accessible locally via RS232.
- WorkaroundIndustrial Managed Switch 852-303wago_psirt
To reduce the attack vector deactivate ssh and telnet on the devices. This ensures that the CLI is only accessible locally via RS232.
- WorkaroundIndustrial Managed Switch 852-602wago_psirt
To reduce the attack vector deactivate ssh and telnet on the devices. This ensures that the CLI is only accessible locally via RS232.
- WorkaroundIndustrial Managed Switch 852-603wago_psirt
To reduce the attack vector deactivate ssh and telnet on the devices. This ensures that the CLI is only accessible locally via RS232.
- WorkaroundLean Managed Switch 852-1812wago_psirt
To eliminate the attack vector deactivate ssh and telnet on the device.
- WorkaroundLean Managed Switch 852-1812/010-000wago_psirt
To eliminate the attack vector deactivate ssh and telnet on the device.
- WorkaroundLean Managed Switch 852-1813wago_psirt
To eliminate the attack vector deactivate ssh and telnet on the device.
- WorkaroundLean Managed Switch 852-1813/000-001wago_psirt
To eliminate the attack vector deactivate ssh and telnet on the device.
- WorkaroundLean Managed Switch 852-1813/010-000wago_psirt
To eliminate the attack vector deactivate ssh and telnet on the device.
- WorkaroundLean Managed Switch 852-1813/010-001wago_psirt
To eliminate the attack vector deactivate ssh and telnet on the device.
- WorkaroundLean Managed Switch 852-1816wago_psirt
To eliminate the attack vector deactivate ssh and telnet on the device.
- WorkaroundLean Managed Switch 852-1816/010-000wago_psirt
To eliminate the attack vector deactivate ssh and telnet on the device.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (94)
Products and version ranges known to be affected.
- Firmware V1.0.6.S0 installed on Industrial Managed Switch 852-602all versionscisa_csaf_otUScpe:2.3:o:wago:switch:V1.0.6.S0:*:*:*:*:*:*:*
- Firmware V1.1.9.S0 installed on Industrial Managed Switch 852-1505all versionscisa_csaf_otUScpe:2.3:o:wago:switch:V1.1.9.S0:*:*:*:*:*:*:*
advisories (2)
Vendor and ecosystem advisories describing this.
- VDE-2026-020WAGO: Vulnerability in managed switches2026-03-23csaf · wago_psirtDE
A vulnerability has been found affecting the Managed Switches of WAGO. An unauthenticated attacker can fully compromise the device via an undocumented function.
- ICSA-26-085-01WAGO GmbH & Co. KG Industrial Managed Switches2026-03-23icsa · cisa_csaf_otUS
A vulnerability has been found affecting the Managed Switches of WAGO. An unauthenticated attacker can fully compromise the device via an undocumented function.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (4)
External citations — patches, advisories, analysis.
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan