Wago 0852-1322 vulnerabilities

4 CVEs affecting Wago 0852-1322, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-22906, published 2026-02-09.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-22903, published 2026-02-09. Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days. An unauthenticated remote attacker can send a crafted HTTP request containing an overly long SESSIONID cookie. This can trigger a stack buffer overflow in the modified lighttpd server, causing it to…
CVE-2026-22905, published 2026-02-09. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. An unauthenticated remote attacker can bypass authentication by exploiting insufficient URI validation and using path traversal sequences (e.g., /js/../cgi-bin/post.cgi), gaining unauthorized access…
CVE-2026-22904, published 2026-02-09. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. Improper length handling when parsing multiple cookie fields (including TRACKID) allows an unauthenticated remote attacker to send oversized cookie values and trigger a stack buffer overflow,…
CVE-2026-22906, published 2026-02-09. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. User credentials are stored using AES‑ECB encryption with a hardcoded key. An unauthenticated remote attacker obtaining the configuration file can decrypt and recover plaintext usernames and…