Description
User credentials are stored using AES‑ECB encryption with a hardcoded key. An unauthenticated remote attacker obtaining the configuration file can decrypt and recover plaintext usernames and passwords, especially when combined with the authentication bypass.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WAGO | 0852-1322 | 0.0.0 – ≤ 2.64, 2.64 | — |
| WAGO | 0852-1328 | 0.0.0 – ≤ 2.64, 2.64 | — |
Advisories 1
- VDE-2026-004 WAGO: Vulnerabilities in Managed Switch CERT@VDE · Feb 9, 2026