Device Sphere CVE-2026-2328

Remote unauthenticated attacker exploiting path traversal in backend component access. No special configuration required — affects default installations. CVSS:3.1/AV:N/AC:L/PR:N/UI:N indicates network-accessible vulnerability without authentication or user interaction needed.

Real-world risk is elevated due to the CVSS vector profile: network-accessible (AV:N), low complexity (AC:L), and requiring no authentication (PR:N) or user interaction (UI:N). This creates a broad attack surface exploitable by any network-adjacent threat actor. The High confidentiality impact (C:H) signals potential exposure of sensitive industrial control system data, credentials, or proprietary configurations. However, lack of integrity or availability impact (I:N, A:N) limits this to an information disclosure vector rather than operational disruption. No EPSS score is provided, preventing probabilistic exploitation forecasting. No public exploit identified at time of analysis, and CISA KEV status not confirmed, suggesting this is not yet widely weaponized. The industrial automation context and unauthenticated attack vector make this a priority for asset owners in manufacturing, energy, or critical infrastructure sectors where WAGO products are deployed, especially if these management interfaces are exposed to untrusted networks. Organizations with proper network segmentation (isolating OT management from IT/internet) face reduced practical risk.

An external attacker scans internet-exposed industrial networks and identifies a WAGO Device Sphere management portal on TCP port 443. Without requiring credentials, the attacker crafts HTTP requests containing path traversal sequences (e.g., '/api/../../../../etc/config.xml') to bypass application routing logic and access backend filesystem paths or API endpoints. Successfully exploiting insufficient input validation, the attacker retrieves sensitive configuration files containing device credentials, network topology, PLC firmware versions, or proprietary automation logic. This information enables reconnaissance for subsequent attacks targeting operational technology assets, credential stuffing, or supply chain intelligence gathering. No public exploit identified at time of analysis, but the low attack complexity and clear CVSS vector suggest proof-of-concept development is straightforward for skilled attackers.