CVE-2025-41730: Wago 0852-1322 Firmware

Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days.

An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_account() function to write arbitrary data into fixed-size stack buffers which leads to full device compromise.

Affected products

• Wago 0852-1322 Firmware: before 02.64 (fixed in 02.64)
• Wago 0852-1328 Firmware: before 02.64 (fixed in 02.64)

Published 2025-12-10. Last modified 2026-09-25.