Summary
A vulnerability has been found affecting the Managed Switches of WAGO. An unauthenticated attacker can fully compromise the device via an undocumented function.
Details
Impact
This could lead to a full System compromise of the affected devices.
Remediation
Please update your devices to the specified fixed firmware version.
| Product | Fixed Version |
|-------------------------------------------|---------------|
| Lean Managed Switch 852-1812 | V1.2.1.S1 |
| Lean Managed Switch 852-1813 | V1.2.1.S1 |
| Lean Managed Switch 852-1813/000-001| V1.2.3.S1 |
| Lean Managed Switch 852-1816 | V1.2.1.S1 |
| Industrial Managed Switch 852-303 | V1.2.8.S1 |
| Industrial Managed Switch 852-1305 | V1.2.0.S1 |
| Industrial Managed Switch 852-1305/000-001| V1.2.0.S1 |
| Industrial Managed Switch 852-1505/000-001| V1.2.0.S1 |
| Industrial Managed Switch 852-1505 | V1.1.9.S1 |
| Industrial Managed Switch 852-602 | V1.0.6.S1 |
| Industrial Managed Switch 852-603 | V1.0.6.S1 |
| Industrial Managed Switch 852-1605 | V1.2.5.S1 |
| Lean Managed Switch 852-1812/010-000| V1.2.1.S1 |
| Lean Managed Switch 852-1813/010-000| V1.2.1.S1 |
| Lean Managed Switch 852-1813/010-001| V1.2.1.S1 |
| Lean Managed Switch 852-1816/010-000| V1.2.1.S1 |
Vulnerabilities 1
-
Critical 10.0
Hidden CLI Function Allows Root Access
An unauthenticated remote attacker can exploit a hidden function in the CLI prompt to escape the restricted interface, leading to full compromise of the device.
Revision history
-
#1.0.0
Release version.
References
-
WAGO PSIRT
https://www.wago.com/de-en/automation-technology/psirt
-
CERT@VDE Security Advisories for WAGO
https://certvde.com/de/advisories/vendor/wago/
-
VDE-2026-020: WAGO: Vulnerability in managed switches - HTML
https://certvde.com/en/advisories/VDE-2026-020