WAGO 852 Switches
CVE-2025-41730
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach device management interface
-
DeliverySend crafted input to check_account()
-
ExploitOverflow fixed-size stack buffer via unsafe sscanf
-
ExecutionHijack control flow / execute code
-
ImpactFull device compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions beyond network reachability - the flaw is an unauthenticated (PR:N), remote (AV:N), low-complexity (AC:L) stack overflow in the check_account() routine of affected WAGO 852-1328/852-1322 switch firmware, reachable pre-authentication with no user interaction. The practical limiting factor is exposure: these are industrial managed switches typically deployed on segmented OT/plant networks rather than the public internet, so an attacker must first obtain a network path to the device's management interface. No non-default configuration is required to trigger the bug. |
| Impact | All signals point to a genuinely high-severity flaw. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) is internally consistent with the description: an unauthenticated, remote, low-complexity stack buffer overflow (CWE-121) in check_account() yielding full device compromise (C:H/I:H/A:H). I concur with the 9.8. However, exploitation-probability signals temper the urgency: EPSS is only 0.43% (35th percentile), there is no CISA KEV listing, and no public exploit code was identified - so this is not currently subject to observed mass exploitation. The gap between the maximal impact score and the modest EPSS is best explained by the affected product being a niche industrial device rather than a mass-internet-facing service, and by the absence (so far) of a public PoC. No SSVC decision data was provided in the input. Net: treat as a real patch priority for anyone operating the affected WAGO switches (unauth pre-auth RCE on OT hardware is a worst-case class), but its current real-world exploitation is unproven rather than widespread. The advisory originates from CERT@VDE (VDE-2025-095), a credible industrial-CERT source, which raises confidence in the technical accuracy even though only a single reference is present. |
| Exploit ScenarioDerived | An attacker with network reachability to the device's management/authentication interface sends a crafted account/credential string that check_account() parses with an unbounded sscanf, overflowing a fixed-size stack buffer and overwriting the return address to hijack control flow - no credentials or user interaction needed. Because the sink is in account handling, it is reachable pre-authentication, so a single crafted request can lead to full device takeover. No public proof-of-concept exploit was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Unauthenticated remote attackers can exploit a stack-based buffer overflow in the check_account() function of WAGO 852-1328 and 852-1322 industrial switch firmware, leading to full device compromise. The flaw arises from unsafe sscanf calls that write arbitrary data into fixed-size stack buffers without bounds checking. With a CVSS score of 9.8, the vulnerability is critical, though EPSS indicates low exploitation likelihood (0.43%); no public exploit identified at time of analysis. Affected devices are typically deployed on segmented OT networks, limiting exposure to attackers with network access to the management interface.
RemediationAI
No vendor-released patch identified at time of analysis; consult the advisory at https://certvde.com/de/advisories/VDE-2025-095 for updates. Until a patch is available, restrict network access to the device's management interface (typically HTTPS on port 443 or SSH on port 22) to trusted administrative hosts only via firewall rules or network segmentation. This mitigation reduces the attack surface but may limit remote management capabilities. Additionally, disable any unnecessary remote management features and monitor network traffic for anomalous requests to the authentication endpoints. In OT environments where remote management is essential, consider using a VPN or jump host to enforce authentication and encryption. Note that these compensating controls do not eliminate the vulnerability and should be combined with timely patching once available.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic stack-based buffer overflow (CWE-121) in the firmware of WAGO 852-1328 and 852-1322 managed industrial switches. The check_account() function likely handles authentication or account verification, and it uses sscanf() to parse user-supplied input without validating the length, allowing an attacker to overwrite the return address or other stack data. This can lead to arbitrary code execution with the privileges of the affected process, resulting in full device compromise. The CPE strings confirm the affected firmware for both models. The flaw is remotely exploitable pre-authentication (PR:N) over the network (AV:N) with low complexity (AC:L), requiring no user interaction (UI:N). Industrial control systems like these are often used in critical infrastructure, making patching and network segmentation critical.
Know when 0852 1328 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated pre-auth network-reachable stack overflow with no user interaction (AV:N/AC:L/PR:N/UI:N) yielding code execution and full device compromise (C:H/I:H/A:H).
Primary rating from Vendor (cert).
CVSS VectorVendor: cert
DescriptionCVE.org
An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_account() function to write arbitrary data into fixed-size stack buffers which leads to full device compromise.
Executive ViewAI
WAGO 852-1328 and 852-1322 industrial Ethernet switches can be fully taken over by a remote attacker who reaches the management interface, and no vendor-released patch is currently available. Because these switches sit inside operational technology networks that are difficult to take offline and are often poorly monitored, a successful compromise could disrupt industrial processes and give an attacker a durable foothold for lateral movement into production environments. Leadership should care because remediation depends entirely on network-level containment until WAGO ships firmware, and the affected devices are concentrated in critical OT segments rather than general IT.
No vendor-released patch identified at time of analysis. Interim mitigations: strictly segment affected switches into isolated OT VLANs with no IT or internet reachability; restrict management interface access to a hardened jump host with MFA; disable remote/web management and unused services; block inbound access to management ports at the network perimeter and between OT zones; enable and centrally collect device and firewall logs; monitor for malformed management requests and anomalous reboots or configuration changes; and maintain spare/replacement units so unsegmentable devices can be swapped quickly.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
GitHub PoC
Exploit-DB