WAGO Industrial Managed Switches - Critical Vulnerability Alert

The Flaw

WAGO GmbH & Co. KG has identified a critical vulnerability in its Industrial Managed Switches. This flaw allows an unauthenticated remote attacker to exploit a hidden function within the Command Line Interface (CLI) prompt. By escaping the restricted interface, attackers can gain full control over the affected devices. This vulnerability is tracked as CVE-2026-3587 and has a CVSS score of 10, indicating its severity.

The affected firmware versions include several models of WAGO hardware, specifically those prior to version V1.2.1.S0 for models 852-1812 and 852-1813, among others. The widespread nature of this vulnerability makes it a significant concern for users globally.

What's at Risk

The vulnerability impacts various sectors, including commercial facilities, critical manufacturing, energy, and transportation systems. Given that these devices are integral to operational technology environments, a successful exploit could lead to severe disruptions. Attackers could manipulate operations, steal sensitive data, or even cause physical damage to infrastructure.

The devices affected include multiple versions of WAGO hardware, such as 852-1812, 852-1813, and 852-303. With many installations worldwide, the potential for widespread impact is alarming.

Patch Status

WAGO has released firmware updates to address this vulnerability. Users are urged to upgrade to the fixed firmware versions, including V1.2.1.S1 for the Lean Managed Switch models and V1.2.3.S1 for specific Industrial Managed Switches. These updates are crucial for mitigating the risk of exploitation.

Additionally, WAGO recommends deactivating SSH and Telnet on affected devices to limit access to the CLI, thereby reducing the attack surface. Ensuring that devices are not exposed to the internet is also critical for maintaining security.

Immediate Actions

Organizations using WAGO Industrial Managed Switches should take immediate action to protect their systems. Here are the recommended steps:

• Update firmware to the latest versions as specified by WAGO.
• Deactivate SSH and Telnet on affected devices to prevent unauthorized access.
• Limit network exposure for all control system devices, ensuring they are not accessible from the internet.

By following these recommendations, organizations can significantly reduce the risk associated with this critical vulnerability and safeguard their operational technology environments.