{"document":{"acknowledgments":[{"organization":"CERT@VDE","summary":"coordination"},{"organization":"Diconium","summary":"reporting"}],"aggregate_severity":{"namespace":"https://www.first.org/cvss/v3.1/specification-document#Qualitative-Severity-Rating-Scale","text":"High"},"category":"csaf_security_advisory","csaf_version":"2.0","distribution":{"tlp":{"label":"WHITE","url":"https://www.first.org/tlp/"}},"lang":"en-GB","notes":[{"category":"summary","text":"Several vulnerabilities have been identified in the WAGO 852‑1328 device's web‑based management interface, which is implemented using a modified lighttpd server and custom CGI binaries. These issues include multiple stack buffer overflows, an authentication bypass, and insecure credential storage.","title":"Summary"},{"category":"description","text":"Successful exploitation may allow remote attackers to crash the web service, execute arbitrary code, bypass authentication controls, and obtain plaintext administrative credentials.","title":"Impact"},{"category":"description","text":"Please update your devices to the specified fixed firmware version 02.65.","title":"Remediation"}],"publisher":{"category":"vendor","contact_details":"psirt@wago.com","name":"WAGO GmbH & Co. KG","namespace":"https://www.wago.com/psirt"},"references":[{"category":"self","summary":"WAGO PSIRT","url":"https://www.wago.com/de-en/automation-technology/psirt"},{"category":"external","summary":"CERT@VDE Security Advisories for WAGO","url":"https://certvde.com/de/advisories/vendor/wago/"},{"category":"self","summary":"VDE-2026-004: WAGO: Vulnerabilities in Managed Switch - HTML","url":"https://certvde.com/en/advisories/VDE-2026-004"},{"category":"self","summary":"VDE-2026-004: WAGO: Vulnerabilities in Managed Switch - CSAF","url":"https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-004.json"}],"title":"WAGO: Vulnerabilities in Managed Switch","tracking":{"aliases":["VDE-2026-004"],"current_release_date":"2026-02-09T08:00:00.000Z","generator":{"date":"2026-02-05T10:35:01.126Z","engine":{"name":"Secvisogram","version":"2.5.42"}},"id":"VDE-2026-004","initial_release_date":"2026-02-09T08:00:00.000Z","revision_history":[{"date":"2026-02-09T08:00:00.000Z","number":"1.0.0","summary":"Release version."}],"status":"final","version":"1.0.0"}},"product_tree":{"branches":[{"branches":[{"branches":[{"branches":[{"category":"product_name","name":"0852-1322","product":{"name":"Industrial-Managed-Switch 0852-1322","product_id":"CSAFPID-11001","product_identification_helper":{"model_numbers":["0852-1322"]}}},{"category":"product_name","name":"0852-1328","product":{"name":"Industrial-Managed-Switch 0852-1328","product_id":"CSAFPID-11002","product_identification_helper":{"model_numbers":["0852-1328"]}}}],"category":"product_family","name":"Industrial-Managed-Switch"}],"category":"product_family","name":"Hardware"},{"branches":[{"category":"product_version_range","name":"vers:generic/<=2.64","product":{"name":"Firmware vers:generic/<=2.64","product_id":"CSAFPID-21001"}},{"category":"product_version","name":"2.65","product":{"name":"Firmware 2.65","product_id":"CSAFPID-22001","product_identification_helper":{"cpe":"cpe:2.3:o:wago:switch:2.65:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"2.64","product":{"name":"Firmware 2.64","product_id":"CSAFPID-21002","product_identification_helper":{"cpe":"cpe:2.3:o:wago:switch:2.64:*:*:*:*:*:*:*"}}}],"category":"product_family","name":"Firmware"}],"category":"vendor","name":"WAGO"}],"product_groups":[{"group_id":"CSAFGID-0001","product_ids":["CSAFPID-31001","CSAFPID-31002","CSAFPID-31003","CSAFPID-31004"],"summary":"Affected products"},{"group_id":"CSAFGID-0002","product_ids":["CSAFPID-32001","CSAFPID-32002"],"summary":"Fixed products"}],"relationships":[{"category":"installed_on","full_product_name":{"name":"Firmware <=2.64 installed on Industrial-Managed-Switch 0852-1322","product_id":"CSAFPID-31001","product_identification_helper":{"model_numbers":["0852-1322"]}},"product_reference":"CSAFPID-21001","relates_to_product_reference":"CSAFPID-11001"},{"category":"installed_on","full_product_name":{"name":"Firmware 2.65 installed on Industrial-Managed-Switch 0852-1322","product_id":"CSAFPID-32001","product_identification_helper":{"model_numbers":["0852-1328"]}},"product_reference":"CSAFPID-22001","relates_to_product_reference":"CSAFPID-11001"},{"category":"installed_on","full_product_name":{"name":"Firmware <=2.64 installed on Industrial-Managed-Switch 0852-1328","product_id":"CSAFPID-31002","product_identification_helper":{"model_numbers":["0852-1322"]}},"product_reference":"CSAFPID-21001","relates_to_product_reference":"CSAFPID-11002"},{"category":"installed_on","full_product_name":{"name":"Firmware 2.65 installed on Industrial-Managed-Switch 0852-1328","product_id":"CSAFPID-32002","product_identification_helper":{"model_numbers":["0852-1328"]}},"product_reference":"CSAFPID-22001","relates_to_product_reference":"CSAFPID-11002"},{"category":"installed_on","full_product_name":{"name":"Firmware 2.64 installed on Industrial-Managed-Switch 0852-1322","product_id":"CSAFPID-31003","product_identification_helper":{"model_numbers":["0852-1322"]}},"product_reference":"CSAFPID-21002","relates_to_product_reference":"CSAFPID-11001"},{"category":"installed_on","full_product_name":{"name":"Firmware 2.64 installed on Industrial-Managed-Switch 0852-1328","product_id":"CSAFPID-31004","product_identification_helper":{"model_numbers":["0852-1328"]}},"product_reference":"CSAFPID-21002","relates_to_product_reference":"CSAFPID-11002"}]},"vulnerabilities":[{"cve":"CVE-2026-22903","cwe":{"id":"CWE-121","name":"Stack-based Buffer Overflow"},"notes":[{"category":"description","text":"An unauthenticated remote attacker can send a crafted HTTP request containing an overly long SESSIONID cookie. This can trigger a stack buffer overflow in the modified lighttpd server, causing it to crash and potentially enabling remote code execution due to missing stack protections.","title":"CVE description"}],"product_status":{"fixed":["CSAFPID-32001","CSAFPID-32002"],"known_affected":["CSAFPID-31001","CSAFPID-31002","CSAFPID-31003","CSAFPID-31004"]},"remediations":[{"category":"vendor_fix","details":"Please update your devices to the specified fixed firmware version 02.65.","group_ids":["CSAFGID-0001"]}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","environmentalScore":9.8,"environmentalSeverity":"CRITICAL","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","temporalScore":9.8,"temporalSeverity":"CRITICAL","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["CSAFPID-31001","CSAFPID-31002","CSAFPID-31003","CSAFPID-31004"]}],"title":"Stack Overflow via SESSIONID Cookie in lighttpd"},{"cve":"CVE-2026-22904","cwe":{"id":"CWE-121","name":"Stack-based Buffer Overflow"},"notes":[{"category":"description","text":"Improper length handling when parsing multiple cookie fields (including TRACKID) allows an unauthenticated remote attacker to send oversized cookie values and trigger a stack buffer overflow, resulting in a denial‑of‑service condition and possible remote code execution.","title":"CVE description"}],"product_status":{"fixed":["CSAFPID-32001","CSAFPID-32002"],"known_affected":["CSAFPID-31001","CSAFPID-31002","CSAFPID-31003","CSAFPID-31004"]},"remediations":[{"category":"vendor_fix","details":"Please update your devices to the specified fixed firmware version 02.65.","group_ids":["CSAFGID-0001"]}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","environmentalScore":9.8,"environmentalSeverity":"CRITICAL","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","temporalScore":9.8,"temporalSeverity":"CRITICAL","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["CSAFPID-31001","CSAFPID-31002","CSAFPID-31003","CSAFPID-31004"]}],"title":"Stack Overflow via Oversized Cookie Fields in lighttpd"},{"cve":"CVE-2026-22905","cwe":{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"},"notes":[{"category":"description","text":"An unauthenticated remote attacker can bypass authentication by exploiting insufficient URI validation and using path traversal sequences (e.g., /js/../cgi-bin/post.cgi), gaining unauthorized access to protected CGI endpoints and configuration downloads.","title":"CVE description"}],"product_status":{"fixed":["CSAFPID-32001","CSAFPID-32002"],"known_affected":["CSAFPID-31001","CSAFPID-31002","CSAFPID-31003","CSAFPID-31004"]},"remediations":[{"category":"vendor_fix","details":"Please update your devices to the specified fixed firmware version 02.65.","group_ids":["CSAFGID-0001"]}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","environmentalScore":7.5,"environmentalSeverity":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","temporalScore":7.5,"temporalSeverity":"HIGH","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["CSAFPID-31001","CSAFPID-31002","CSAFPID-31003","CSAFPID-31004"]}],"title":"Authentication Bypass via URI Traversal"},{"cve":"CVE-2026-22906","cwe":{"id":"CWE-321","name":"Use of Hard-coded Cryptographic Key"},"notes":[{"category":"description","text":"User credentials are stored using AES‑ECB encryption with a hardcoded key. An unauthenticated remote attacker obtaining the configuration file can decrypt and recover plaintext usernames and passwords, especially when combined with the authentication bypass.","title":"CVE description"}],"product_status":{"fixed":["CSAFPID-32001","CSAFPID-32002"],"known_affected":["CSAFPID-31001","CSAFPID-31002","CSAFPID-31003","CSAFPID-31004"]},"remediations":[{"category":"vendor_fix","details":"Please update your devices to the specified fixed firmware version 02.65.","group_ids":["CSAFGID-0001"]}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","environmentalScore":9.8,"environmentalSeverity":"CRITICAL","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","temporalScore":9.8,"temporalSeverity":"CRITICAL","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["CSAFPID-31001","CSAFPID-31002","CSAFPID-31003","CSAFPID-31004"]}],"title":"Hardcoded Key Allows Credential Disclosure"}]}