Lean Managed Switch 852 1812 EUVD-2026-14385

Remote unauthenticated attacker with network access to the CLI prompt interface. No victim interaction required. Affects default configurations of the Linux-based device with the vulnerable CLI function exposed. No special authentication, configuration settings, or enabled features required.

This vulnerability presents critical real-world risk with maximum exploitability. The CVSS vector AV:N/AC:L/PR:N/UI:N indicates network-accessible exploitation with low complexity requiring no privileges or user interaction, making it fully automatable. The changed scope (S:C) and high impact across all CIA triad elements (C:H/I:H/A:H) reflect the complete system compromise achievable. Industrial managed switches are often deployed in operational technology (OT) and critical infrastructure environments where network segmentation may be inadequate, making remote network access feasible. The combination of no authentication requirement, network accessibility, and root-level compromise in industrial control environments makes this an immediate priority for patching regardless of EPSS score or current KEV status. Attackers targeting industrial environments would prioritize such vulnerabilities for establishing persistent access to OT networks.

An attacker scans the network and identifies WAGO managed switches exposed on the network via fingerprinting of web interfaces or SSH banners. The attacker connects to the CLI interface without authentication, invokes the hidden command sequence to escape the restricted shell, and immediately gains root access to the underlying Linux OS. From this position, the attacker can intercept industrial network traffic, modify switch configurations to enable traffic mirroring, establish persistent backdoors, pivot to other OT systems, or disrupt industrial operations by manipulating switching behavior.