CVE-2026-3587: Hidden CLI Function Allows Root Access

Severity: critical (CVSS 10.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-23 · updated 2026-06-17
Weakness: CWE-912

Description

An unauthenticated remote attacker can exploit a hidden function in the CLI prompt to escape the restricted interface, leading to full compromise of the device.

Affected products

WAGO Industrial Managed Switch 852-1305: before V1.2.0.S0 — fixed in V1.2.0.S0
WAGO Industrial Managed Switch 852-1305-000-001: before V1.2.0.S0 — fixed in V1.2.0.S0
WAGO Industrial Managed Switch 852-1505: before V1.1.9.S0 — fixed in V1.1.9.S0
WAGO Industrial Managed Switch 852-1505-000-001: before V1.2.0.S0 — fixed in V1.2.0.S0
WAGO Industrial Managed Switch 852-1605: before V1.2.5.S0 — fixed in V1.2.5.S0
WAGO Industrial Managed Switch 852-303: before V1.2.8.S0 — fixed in V1.2.8.S0
WAGO Industrial Managed Switch 852-602: before V1.0.6.S0 — fixed in V1.0.6.S0
WAGO Industrial Managed Switch 852-603: before V1.0.6.S0 — fixed in V1.0.6.S0
WAGO Lean Managed Switch 852-1812: before V1.2.1.S0 — fixed in V1.2.1.S0
WAGO Lean Managed Switch 852-1812-010-000: before V1.2.1.S0 — fixed in V1.2.1.S0
WAGO Lean Managed Switch 852-1813: before V1.2.1.S0 — fixed in V1.2.1.S0
WAGO Lean Managed Switch 852-1813-000-001: before V1.2.3.S0 — fixed in V1.2.3.S0
WAGO Lean Managed Switch 852-1813-010-000: before V1.2.1.S0 — fixed in V1.2.1.S0
WAGO Lean Managed Switch 852-1813/010-001: before V1.2.1.S0 — fixed in V1.2.1.S0
WAGO Lean Managed Switch 852-1816: before V1.2.1.S0 — fixed in V1.2.1.S0
WAGO Lean Managed Switch 852-1816-010-000: before V1.2.1.S0 — fixed in V1.2.1.S0

How to fix

Upgrade to a fixed version: WAGO Industrial Managed Switch 852-1305 V1.2.0.S0; WAGO Industrial Managed Switch 852-1305-000-001 V1.2.0.S0; WAGO Industrial Managed Switch 852-1505 V1.1.9.S0; WAGO Industrial Managed Switch 852-1505-000-001 V1.2.0.S0; WAGO Industrial Managed Switch 852-1605 V1.2.5.S0; WAGO Industrial Managed Switch 852-303 V1.2.8.S0; WAGO Industrial Managed Switch 852-602 V1.0.6.S0; WAGO Industrial Managed Switch 852-603 V1.0.6.S0; WAGO Lean Managed Switch 852-1812 V1.2.1.S0; WAGO Lean Managed Switch 852-1812-010-000 V1.2.1.S0; WAGO Lean Managed Switch 852-1813 V1.2.1.S0; WAGO Lean Managed Switch 852-1813-000-001 V1.2.3.S0. Check the vendor advisory for mitigations.

References

https://certvde.com/de/advisories/VDE-2026-020

Get alerted when CVE-2026-3587 or the next vulnerability affects your stack