noindex and left out of the sitemap until more data is confirmed.CVE-2026-3587 is a hidden, undocumented function in the CLI prompt of several WAGO industrial managed switch product lines that lets an unauthenticated remote attacker escape the restricted management shell and fully compromise the device, including gaining root access to its underlying Linux OS; it carries the maximum CVSS v3.1 score of 10.0 but is not (as of this writing) listed in CISA's KEV catalog and has no NVD-assigned Primary CVSS.
Vulnerability summary
10
Critical
0.7%
EPSS score (FIRST)
No
CISA KEV catalog
2026-03-23
Published
Vulnerability ID: CVE-2026-3587 · Source: VDE CERT (CNA)
Affected components
| Component | CPE | Version range |
|---|---|---|
| WAGO Industrial Managed Switch 852-303 | — | firmware prior to V1.2.8.S1 |
| WAGO Industrial Managed Switch 852-602 / 852-603 | — | firmware prior to V1.0.6.S1 |
| WAGO Industrial Managed Switch 852-1305 / 852-1505 | — | firmware prior to V1.2.0.S1 |
| WAGO Industrial Managed Switch 852-1605 | — | firmware prior to V1.2.5.S1 |
| WAGO Lean Managed Switch 852-1812 / 852-1816 | — | firmware prior to V1.2.1.S1 |
| WAGO Lean Managed Switch 852-1813 | — | firmware prior to V1.2.3.S1 (per CERT@VDE VDE-2026-020; CISA ICSA-26-085-01 lists the pre-fix baseline as V1.2.1.S0) |
What does this mean for affected devices?
CVE-2026-3587 affects multiple families of WAGO industrial managed switches — the Industrial Managed Switch series (852-303, 852-602, 852-603, 852-1305, 852-1505, 852-1605) and the Lean Managed Switch series (852-1812, 852-1813, 852-1816) — used across critical manufacturing, energy, transportation, and commercial-facilities environments (CISA ICSA-26-085-01).
The flaw is classified as CWE-912 (Hidden Functionality): the switch's CLI prompt contains a concealed function that an unauthenticated remote attacker can invoke to break out of the restricted management interface. CERT@VDE's coordinated advisory states this grants full, root-level access to the device's underlying Linux-based operating system (CERT@VDE VDE-2026-020).
VDE CERT, acting as the CNA, assigned the maximum possible CVSS v3.1 base score — 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — reflecting network reachability, low attack complexity, no privileges or user interaction required, a scope change, and complete loss of confidentiality, integrity and availability (NVD).
As of this writing, NVD's own record for CVE-2026-3587 is still in Awaiting Analysis status: the only CVSS vector on file is the Secondary score submitted by the CNA ([email protected]), and NVD has not published its own Primary score. The record was first published 2026-03-23 and last modified 2026-06-17 (NVD).
A direct check of the live CISA Known Exploited Vulnerabilities catalog (the raw JSON feed) found no entry for CVE-2026-3587, so there is no confirmed evidence of in-the-wild exploitation at this time (CISA KEV catalog feed). Consistent with that, FIRST's EPSS model scores the probability of exploitation in the next 30 days at just 0.69% (52.8th percentile) as of 2026-10-30 (FIRST EPSS).
WAGO has released fixed firmware (the "S1" revision for each affected model line, e.g. V1.2.8.S1 for the 852-303) and recommends updating immediately. As an interim mitigation where firmware cannot yet be applied, CISA and CERT@VDE both recommend disabling SSH and Telnet management access so the CLI can only be reached via a local RS-232 serial connection, removing the remote attack path (CISA ICSA-26-085-01; CERT@VDE VDE-2026-020).
Because this is a maximum-severity, unauthenticated, network-exploitable flaw in network infrastructure gear that is often deployed at the edge of OT networks, operators should treat the firmware update as urgent even though it has not (yet) been confirmed as exploited in the wild or added to KEV.
Evidence
- Affects WAGO Industrial Managed Switch models 852-303, 852-602, 852-603, 852-1305, 852-1505, 852-1605 and Lean Managed Switch models 852-1812, 852-1813, 852-1816, deployed in Commercial Facilities, Critical Manufacturing, Energy and Transportation Systems sectors worldwide. — CISA ICSA-26-085-01
- CWE-912 Hidden Functionality: an unauthenticated remote attacker can exploit a hidden function in the CLI prompt to escape the restricted interface, leading to full compromise of the device, including root access to the underlying Linux OS. — CERT@VDE VDE-2026-020
- CVSS v3.1 base score 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, submitted as a Secondary score by CNA [email protected]; NVD vulnerability status is 'Awaiting Analysis' with no NVD Primary CVSS as of last modification 2026-06-17. — NVD
- CVE-2026-3587 does not appear in the live CISA Known Exploited Vulnerabilities catalog feed (checked by exact cveID string match). — CISA KEV catalog feed
- FIRST EPSS score is 0.0069 (0.69%), 52.797th percentile, as of 2026-10-30. — FIRST EPSS
- Fixed firmware is available for each affected model (S1 revisions); interim mitigation is to disable SSH and Telnet so CLI access is restricted to a local RS-232 connection. — CISA ICSA-26-085-01
Questions about this page?
