0852 1322 Firmware
Monthly
Unauthenticated remote stack compromise affects WAGO 0852-1328 and 0852-1322 industrial Ethernet switch firmware, where unsafe sscanf parsing inside the check_cookie() function writes attacker-controlled data into fixed-size stack buffers, yielding a full device compromise at CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) with no credentials, no user interaction, and default configuration. The practical barrier is exposure rather than exploitation difficulty: these are OT/ICS switches normally deployed on segmented plant networks, so reachability usually presumes an attacker already positioned on the operational network or a management interface improperly exposed via firewall or VPN misconfiguration. No public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis, and EPSS is low at 0.43% (35th percentile), but the outcome of full device compromise means any internet- or VPN-reachable unit should be patched or isolated promptly.
Unauthenticated remote attackers can exploit a stack-based buffer overflow in the check_account() function of WAGO 852-1328 and 852-1322 industrial switch firmware, leading to full device compromise. The flaw arises from unsafe sscanf calls that write arbitrary data into fixed-size stack buffers without bounds checking. With a CVSS score of 9.8, the vulnerability is critical, though EPSS indicates low exploitation likelihood (0.43%); no public exploit identified at time of analysis. Affected devices are typically deployed on segmented OT networks, limiting exposure to attackers with network access to the management interface.
Unauthenticated remote stack compromise affects WAGO 0852-1328 and 0852-1322 industrial Ethernet switch firmware, where unsafe sscanf parsing inside the check_cookie() function writes attacker-controlled data into fixed-size stack buffers, yielding a full device compromise at CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) with no credentials, no user interaction, and default configuration. The practical barrier is exposure rather than exploitation difficulty: these are OT/ICS switches normally deployed on segmented plant networks, so reachability usually presumes an attacker already positioned on the operational network or a management interface improperly exposed via firewall or VPN misconfiguration. No public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis, and EPSS is low at 0.43% (35th percentile), but the outcome of full device compromise means any internet- or VPN-reachable unit should be patched or isolated promptly.
Unauthenticated remote attackers can exploit a stack-based buffer overflow in the check_account() function of WAGO 852-1328 and 852-1322 industrial switch firmware, leading to full device compromise. The flaw arises from unsafe sscanf calls that write arbitrary data into fixed-size stack buffers without bounds checking. With a CVSS score of 9.8, the vulnerability is critical, though EPSS indicates low exploitation likelihood (0.43%); no public exploit identified at time of analysis. Affected devices are typically deployed on segmented OT networks, limiting exposure to attackers with network access to the management interface.