Critical severity · published Mar 23, 2026
CVE-2026-3587
Hidden CLI Function Allows Root Access
10.0
CVSS
0.7%
EPSS
No
On KEV
Description
An unauthenticated remote attacker can exploit a hidden function in the CLI prompt to escape the restricted interface, leading to full compromise of the device.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IM
Industrial Managed Switch 852-1305 · WAGO
0.0.0 before V1.2.0.S0 · source: vendor
IM
Industrial Managed Switch 852-1305-000-001 · WAGO
0.0.0 before V1.2.0.S0 · source: vendor
IM
Industrial Managed Switch 852-1505 · WAGO
0.0.0 before V1.1.9.S0 · source: vendor
IM
Industrial Managed Switch 852-1505-000-001 · WAGO
0.0.0 before V1.2.0.S0 · source: vendor
IM
Industrial Managed Switch 852-1605 · WAGO
0.0.0 before V1.2.5.S0 · source: vendor
IM
Industrial Managed Switch 852-303 · WAGO
0.0.0 before V1.2.8.S0 · source: vendor
IM
Industrial Managed Switch 852-602 · WAGO
0.0.0 before V1.0.6.S0 · source: vendor
IM
Industrial Managed Switch 852-603 · WAGO
0.0.0 before V1.0.6.S0 · source: vendor
LM
Lean Managed Switch 852-1812 · WAGO
0.0.0 before V1.2.1.S0 · source: vendor
LM
Lean Managed Switch 852-1812-010-000 · WAGO
0.0.0 before V1.2.1.S0 · source: vendor
LM
Lean Managed Switch 852-1813 · WAGO
0.0.0 before V1.2.1.S0 · source: vendor
LM
Lean Managed Switch 852-1813-000-001 · WAGO
0.0.0 before V1.2.3.S0 · source: vendor
In the news
VulnerabilityCritical
WAGO GmbH & Co. KG Industrial Managed Switches
View CSAF
Summary
An unauthenticated remote attacker can exploit a hidden function in the CLI prompt to escape the restricted interface, leading to full compromise of the device.
The following versions of WAGO GmbH & Co. KG Industrial Managed Switches are affected:
WAGO Firmware versions prior to V1.2.1.S0 WAGO_Hardware_852-1812 (CVE-2026-3587)
WAGO Firmware versions prior to V1.2.1.S0 WAGO_Hardware_852-1813 (CVE-2026-3587)
WAGO Firmware versions prior to V1.2.3.S0 WAGO_Hardware_852-1813/000-001 (CVE-2026-3587)
WAGO Firmware versions prior to V1.2.1.S0 WAGO_Hardware_852-1816 (CVE-2026-3587)
WAGO Firmware versions prior to V1.2.8.S0 WAGO_Hardware_852-303 (CVE-2026-3587)
WAGO Firmware versions prior to V1.2.0.S0 WAGO_Hardware_852-1305 (CVE-2026-3587)
WAGO Firmware versions prior to V1.2.0.S0 WAGO_Hardware_852-1305/000-001 (CVE-2026-3587)
WAGO Firmware versions prior to V1.2.0.S0 WAGO_Hardware_852-1505/000-001 (CVE-2026-3587)
WAGO Firmware versions prior to V1.1.9.S0 WAGO_Hardware_852-1505 (CVE-2026-3587)
WAGO Firmware versions prior to V1.0.6.S0 WAGO_Hardware_852-602 (CVE-2026-3587)
WAGO Firmware versions prior to V1.0.6.S0 WAGO_Hardware_852-603 (CVE-2026-3587)
WAGO Firmware versions prior to V1.2.5.S0 WAGO_Hardware_852-1605 (CVE-2026-3587)
WAGO Firmware versions prior to V1.2.1.S0 WAGO_Hardware_852-1812/010-000 (CVE-2026-3587)
WAGO Firmware versions prior to V1.2.1.S0 WAGO_Hardware_852-1813/010-000 (CVE-2026-3587)
WAGO Firmware ver...
Mar 26, 2026·CISA Advisories