WAGO 0852 Switches
CVE-2025-41732
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach switch management interface
-
DeliverySend HTTP request with crafted cookie
-
Exploitsscanf overflows fixed stack buffer in check_cookie()
-
ExecutionHijack control flow, execute code
-
ImpactFull device compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network reachability to the HTTP/management service of a WAGO 0852-1328 or 0852-1322 industrial Ethernet switch that parses cookies via the vulnerable check_cookie() path. No authentication, no user interaction, and no non-default configuration are needed (PR:N/UI:N/AC:L) - exploitation works against default-configured affected devices. The principal limiting factor is exposure: these are OT/ICS switches typically deployed on segmented plant/industrial networks rather than the public internet, so realistic reachability usually presumes an attacker already positioned on the operational network or a device improperly exposed through firewall/VPN misconfiguration. |
| Impact | This is a genuinely high-priority vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8 Critical) is fully consistent with the description: an unauthenticated, remote, low-complexity stack-based buffer overflow (CWE-121) in check_cookie() that yields full device compromise (C:H/I:H/A:H). Every CVSS metric is internally coherent with the technical narrative - there is no network-vs-local contradiction to flag. The counter-signal is EPSS, which sits at only 0.43% (35th percentile), and there is no CISA KEV listing and no public exploit code identified. This apparent tension is expected and not disqualifying: EPSS is trained heavily on internet-facing IT software, and it systematically under-weights OT/ICS network appliances like WAGO industrial switches, which have small internet footprints and low observed mass-scanning activity. The realistic read is that this is a critical, easily weaponizable memory-corruption bug whose LOW EPSS reflects a niche, less-exposed target base - targeted exploitation (an attacker already on the OT/plant network, or a WAGO switch improperly exposed) is far more plausible than internet-wide mass exploitation. No SSVC decision data was supplied. Treat as high priority for organizations running these specific WAGO switches; the ceiling impact (unauthenticated RCE on network infrastructure) justifies prompt patching despite the low probabilistic exploitation score. |
| Exploit ScenarioDerived | An attacker with network reachability to the switch's management interface sends a crafted HTTP request carrying a malformed cookie value. The check_cookie() routine parses the cookie with unsafe sscanf calls that write past fixed-size stack buffers, overflowing the stack and allowing control-flow hijack to execute attacker code as the device's service process. No credentials or user interaction are required (PR:N/UI:N); no public proof-of-concept exploit has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Unauthenticated remote stack compromise affects WAGO 0852-1328 and 0852-1322 industrial Ethernet switch firmware, where unsafe sscanf parsing inside the check_cookie() function writes attacker-controlled data into fixed-size stack buffers, yielding a full device compromise at CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) with no credentials, no user interaction, and default configuration. The practical barrier is exposure rather than exploitation difficulty: these are OT/ICS switches normally deployed on segmented plant networks, so reachability usually presumes an attacker already positioned on the operational network or a management interface improperly exposed via firewall or VPN misconfiguration. No public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis, and EPSS is low at 0.43% (35th percentile), but the outcome of full device compromise means any internet- or VPN-reachable unit should be patched or isolated promptly.
RemediationAI
No vendor-released patched firmware version is identified in the available data; operators must obtain the current fixed firmware release and upgrade instructions directly from WAGO and from CERT VDE advisory VDE-2025-095 (https://certvde.com/de/advisories/VDE-2025-095), and should verify the installed firmware build against that advisory before assuming a device is clean. Until firmware can be applied, the most effective compensating control is reachability reduction, because the vulnerability is only exploitable if an attacker can reach the device's HTTP/management service: block inbound access to the switch web interface (typically TCP 80/443) from untrusted networks at the perimeter and on internal firewalls, place the switch management plane on a dedicated management VLAN with ACLs limited to authorized administrative hosts, and remove any internet- or VPN-exposed management interfaces. Where the web management UI is not operationally required, disabling it removes the attack surface entirely at the cost of losing browser-based administration; if it must remain enabled, add an inline intrusion detection signature or reverse proxy that rejects abnormally long or malformed Cookie headers before they reach check_cookie(), accepting the trade-off of added latency and a possible insertion point for proxy-specific parsing bugs. Because the failure mode indicates working in both directions, monitor for signs of compromise such as unexpected reboots, crash/restart events on the management service, or anomalous outbound traffic from the switch, and treat any previously exposed device as potentially compromised pending forensic review.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-121, a stack-based buffer overflow, introduced by unsafe use of the C library sscanf() family within the check_cookie() routine that parses HTTP Cookie header values on the WAGO 0852 series management/web service. Because sscanf conversions are performed without field-width limits or adequate length validation, an attacker-supplied cookie string can overrun fixed-size stack buffers, corrupting adjacent stack memory including saved return addresses or function pointers and thereby redirecting execution to attacker-controlled data. No input sanitization or bounds checking stands between the network-facing parser and the stack, so the flaw is reachable over the network before any authentication step. The CPE records identify the vulnerable components as the firmware images for WAGO models 0852-1328 and 0852-1322 (cpe:2.3:o:wago:0852-1328_firmware and cpe:2.3:o:wago:0852-1322_firmware), both wireless/industrial Ethernet switch families in WAGO's automation portfolio, which is why the downstream impact set (C:H/I:H/A:H) applies to the device as a whole rather than to a single application process - these devices serve as network infrastructure in industrial control environments.
Know when 0852 1328 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable stack overflow with no user interaction (AV:N/AC:L/PR:N/UI:N) yielding full device code execution, so C/I/A all High; scope unchanged as compromise stays within the device.
Primary rating from Vendor (cert).
CVSS VectorVendor: cert
DescriptionCVE.org
An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_cookie() function to write arbitrary data into fixed-size stack buffers which leads to full device compromise.
Executive ViewAI
WAGO 0852-1328 and 0852-1322 industrial Ethernet switches are affected by a critical unauthenticated remote stack compromise vulnerability that can lead to full device takeover. Because these switches are commonly deployed in OT/ICS environments, a successful exploit could disrupt industrial processes, halt production, or enable lateral movement into sensitive networks. Despite no public exploit identified at time of analysis, the severity and potential for operational disruption require immediate leadership attention to isolate any internet- or VPN-reachable units.
No vendor-released patch identified at time of analysis. Interim mitigations include isolating affected devices from untrusted networks, restricting management interface access, disabling unnecessary remote management services, and monitoring network traffic for exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
GitHub PoC
Exploit-DB