Read the docs
TI-2026-03092 Aliases CVE-2026-3587GHSA-4r7q-86hg-h98x

Hidden CLI Function Allows Root Access

Priority MEDIUM 50CWE-912Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

An unauthenticated remote attacker can exploit a hidden function in the CLI prompt to escape the restricted interface, leading to full compromise of the device.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00691 53rd percentileScored 2026-11-07
Fix Fixed Lean Managed Switch 852-1812 (WAGO): V1.2.1.S0Lean Managed Switch 852-1813 (WAGO): V1.2.1.S0+14 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WAGOLean Managed Switch 852-18120.0.0 to before V1.2.1.S0V1.2.1.S0Patch availableCNA
WAGOLean Managed Switch 852-18130.0.0 to before V1.2.1.S0V1.2.1.S0Patch availableCNA
WAGOLean Managed Switch 852-1813-000-0010.0.0 to before V1.2.3.S0V1.2.3.S0Patch availableCNA
WAGOLean Managed Switch 852-18160.0.0 to before V1.2.1.S0V1.2.1.S0Patch availableCNA
WAGOIndustrial Managed Switch 852-3030.0.0 to before V1.2.8.S0V1.2.8.S0Patch availableCNA
WAGOIndustrial Managed Switch 852-13050.0.0 to before V1.2.0.S0V1.2.0.S0Patch availableCNA
WAGOIndustrial Managed Switch 852-1305-000-0010.0.0 to before V1.2.0.S0V1.2.0.S0Patch availableCNA
WAGOIndustrial Managed Switch 852-1505-000-0010.0.0 to before V1.2.0.S0V1.2.0.S0Patch availableCNA
WAGOIndustrial Managed Switch 852-15050.0.0 to before V1.1.9.S0V1.1.9.S0Patch availableCNA
WAGOIndustrial Managed Switch 852-6020.0.0 to before V1.0.6.S0V1.0.6.S0Patch availableCNA
WAGOIndustrial Managed Switch 852-6030.0.0 to before V1.0.6.S0V1.0.6.S0Patch availableCNA
WAGOIndustrial Managed Switch 852-16050.0.0 to before V1.2.5.S0V1.2.5.S0Patch availableCNA
WAGOLean Managed Switch 852-1812-010-0000.0.0 to before V1.2.1.S0V1.2.1.S0Patch availableCNA
WAGOLean Managed Switch 852-1813-010-0000.0.0 to before V1.2.1.S0V1.2.1.S0Patch availableCNA
WAGOLean Managed Switch 852-1816-010-0000.0.0 to before V1.2.1.S0V1.2.1.S0Patch availableCNA
WAGOLean Managed Switch 852-1813/010-0010.0.0 to before V1.2.1.S0V1.2.1.S0Patch availableCNA
  • Lean Managed Switch 852-1812 VendorWAGO Affected 0.0.0 to before V1.2.1.S0 Fixed in V1.2.1.S0 Patch available CNA
  • Lean Managed Switch 852-1813 VendorWAGO Affected 0.0.0 to before V1.2.1.S0 Fixed in V1.2.1.S0 Patch available CNA
  • Lean Managed Switch 852-1813-000-001 VendorWAGO Affected 0.0.0 to before V1.2.3.S0 Fixed in V1.2.3.S0 Patch available CNA
  • Lean Managed Switch 852-1816 VendorWAGO Affected 0.0.0 to before V1.2.1.S0 Fixed in V1.2.1.S0 Patch available CNA
  • Industrial Managed Switch 852-303 VendorWAGO Affected 0.0.0 to before V1.2.8.S0 Fixed in V1.2.8.S0 Patch available CNA
  • Industrial Managed Switch 852-1305 VendorWAGO Affected 0.0.0 to before V1.2.0.S0 Fixed in V1.2.0.S0 Patch available CNA
  • Industrial Managed Switch 852-1305-000-001 VendorWAGO Affected 0.0.0 to before V1.2.0.S0 Fixed in V1.2.0.S0 Patch available CNA
  • Industrial Managed Switch 852-1505-000-001 VendorWAGO Affected 0.0.0 to before V1.2.0.S0 Fixed in V1.2.0.S0 Patch available CNA
  • Industrial Managed Switch 852-1505 VendorWAGO Affected 0.0.0 to before V1.1.9.S0 Fixed in V1.1.9.S0 Patch available CNA
  • Industrial Managed Switch 852-602 VendorWAGO Affected 0.0.0 to before V1.0.6.S0 Fixed in V1.0.6.S0 Patch available CNA
  • Industrial Managed Switch 852-603 VendorWAGO Affected 0.0.0 to before V1.0.6.S0 Fixed in V1.0.6.S0 Patch available CNA
  • Industrial Managed Switch 852-1605 VendorWAGO Affected 0.0.0 to before V1.2.5.S0 Fixed in V1.2.5.S0 Patch available CNA
  • Lean Managed Switch 852-1812-010-000 VendorWAGO Affected 0.0.0 to before V1.2.1.S0 Fixed in V1.2.1.S0 Patch available CNA
  • Lean Managed Switch 852-1813-010-000 VendorWAGO Affected 0.0.0 to before V1.2.1.S0 Fixed in V1.2.1.S0 Patch available CNA
  • Lean Managed Switch 852-1816-010-000 VendorWAGO Affected 0.0.0 to before V1.2.1.S0 Fixed in V1.2.1.S0 Patch available CNA
  • Lean Managed Switch 852-1813/010-001 VendorWAGO Affected 0.0.0 to before V1.2.1.S0 Fixed in V1.2.1.S0 Patch available CNA

Remediation

  • Fix · CNA Lean Managed Switch 852-1812 (WAGO) Fixed in V1.2.1.S0
  • Fix · CNA Lean Managed Switch 852-1813 (WAGO) Fixed in V1.2.1.S0
  • Fix · CNA Lean Managed Switch 852-1813-000-001 (WAGO) Fixed in V1.2.3.S0
  • Fix · CNA Lean Managed Switch 852-1816 (WAGO) Fixed in V1.2.1.S0
  • Fix · CNA Industrial Managed Switch 852-303 (WAGO) Fixed in V1.2.8.S0
  • Fix · CNA Industrial Managed Switch 852-1305 (WAGO) Fixed in V1.2.0.S0
  • Fix · CNA Industrial Managed Switch 852-1305-000-001 (WAGO) Fixed in V1.2.0.S0
  • Fix · CNA Industrial Managed Switch 852-1505-000-001 (WAGO) Fixed in V1.2.0.S0
  • Fix · CNA Industrial Managed Switch 852-1505 (WAGO) Fixed in V1.1.9.S0
  • Fix · CNA Industrial Managed Switch 852-602 (WAGO) Fixed in V1.0.6.S0
  • Fix · CNA Industrial Managed Switch 852-603 (WAGO) Fixed in V1.0.6.S0
  • Fix · CNA Industrial Managed Switch 852-1605 (WAGO) Fixed in V1.2.5.S0
  • Fix · CNA Lean Managed Switch 852-1812-010-000 (WAGO) Fixed in V1.2.1.S0
  • Fix · CNA Lean Managed Switch 852-1813-010-000 (WAGO) Fixed in V1.2.1.S0
  • Fix · CNA Lean Managed Switch 852-1816-010-000 (WAGO) Fixed in V1.2.1.S0
  • Fix · CNA Lean Managed Switch 852-1813/010-001 (WAGO) Fixed in V1.2.1.S0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-3587
  2. 2026-10-03 Alias added: GHSA-4r7q-86hg-h98x
  3. 2026-10-16 EPSS moved to the 50th–90th percentile

References

Other 1

  • TI-2023-01594 WAGO: WBM Command Injection in multiple products CVSS 3.1CRITICAL 9.8
  • TI-2020-06893 eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eap_request and eap_response functions. CVSS 3.1CRITICAL 9.8
  • TI-2018-09314 An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware… CVSS 3.1HIGH 8.8
  • TI-2025-18921 Unauthenticated File Read via Web Interface CVSS 3.1MEDIUM 4.9
  • TI-2026-18391 Stack Overflow via Oversized Cookie Fields in lighttpd CVSS 3.1CRITICAL 9.8
  • TI-2026-18390 Stack Overflow via SESSIONID Cookie in lighttpd CVSS 3.1CRITICAL 9.8
See all 145 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences