CVE-2026-3587

An unauthenticated remote attacker can exploit a hidden function in the CLI prompt to escape the restricted interface, leading to full compromise of the device.

Score

CVSS 3.1 10.0 Critical

Status

Awaiting Analysis - info@cert.vde.com

Published

2026-03-23

Last modified

2026-03-24

Weaknesses

CWE-912

Affected products

• Industrial Managed Switch 852-1305 (Wago)
• Industrial Managed Switch 852-1305-000-001 (Wago)
• Industrial Managed Switch 852-1505 (Wago)
• Industrial Managed Switch 852-1505-000-001 (Wago)
• Industrial Managed Switch 852-1605 (Wago)
• Industrial Managed Switch 852-303 (Wago)
• Industrial Managed Switch 852-602 (Wago)
• Industrial Managed Switch 852-603 (Wago)
• Lean Managed Switch 852-1812 (Wago)
• Lean Managed Switch 852-1812-010-000 (Wago)
• Lean Managed Switch 852-1813 (Wago)
• Lean Managed Switch 852-1813-000-001 (Wago)
• Lean Managed Switch 852-1813-010-000 (Wago)
• Lean Managed Switch 852-1813010-001 (Wago)
• Lean Managed Switch 852-1816 (Wago)
• Lean Managed Switch 852-1816-010-000 (Wago)

References

• https://certvde.com/de/advisories/VDE-2026-020