CVE-2026-22905: Wago 0852-1322

High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days.

An unauthenticated remote attacker can bypass authentication by exploiting insufficient URI validation and using path traversal sequences (e.g., /js/../cgi-bin/post.cgi), gaining unauthorized access to protected CGI endpoints and configuration downloads.

Affected products

• Wago 0852-1322: from 0.0.0, up to and including 2.64; version 2.64 only
• Wago 0852-1328: from 0.0.0, up to and including 2.64; version 2.64 only

Published 2026-02-09. Last modified 2026-06-17.