CVE-2025-1235: WAGO: Switches affected by year 2k38 problem

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-06-02 · updated 2026-06-17
Weakness: CWE-190

Description

A low privileged attacker can set the date of the devices to the 19th of January 2038 an therefore exceed the 32-Bit time limit. This causes the date of the switch to be set back to January 1st, 1970.

Affected products

WAGO Fully Managed Switches 0852-0303: all versions
WAGO Fully Managed Switches 0852-1305: all versions
WAGO Fully Managed Switches 0852-1305/0000-0001: all versions
WAGO Fully Managed Switches 0852-1505: all versions
WAGO Fully Managed Switches 0852-1505/0000-0001: all versions
WAGO Lean Managed Switches 0852-1812: all versions
WAGO Lean Managed Switches 0852-1812/0010-0000: all versions
WAGO Lean Managed Switches 0852-1813: all versions
WAGO Lean Managed Switches 0852-1813/0000-0001: all versions
WAGO Lean Managed Switches 0852-1813/0010-0000: all versions
WAGO Lean Managed Switches 0852-1813/0010-0001: all versions
WAGO Lean Managed Switches 0852-1816: all versions
WAGO Lean Managed Switches 0852-1816/0010-0000: all versions

References

https://cert.vde.com/en/advisories/VDE-2025-020

Get alerted when CVE-2025-1235 or the next vulnerability affects your stack