CVE-2026-3587 WAGO CVE debrief

Who should care

OT/ICS defenders, plant network administrators, system integrators, and anyone operating WAGO 852-series industrial managed switches—especially where management access is reachable over IP or exposed beyond a tightly controlled maintenance network.

Technical summary

The source advisory describes a network-reachable, unauthenticated flaw in the device CLI path. Attackers can use a hidden CLI function to break out of the restricted interface and obtain elevated access, with the impact characterized as full device compromise. The supplied CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (10.0/Critical). Affected firmware is any version below the model-specific fixed releases listed in the advisory. The advisory also notes a workaround: disable SSH and Telnet to reduce the attack vector, leaving CLI access local via RS232 on the applicable devices.

Defensive priority

Immediate. This is a critical, unauthenticated network-accessible management-plane issue with high confidentiality, integrity, and availability impact. Prioritize rapid asset identification, exposure reduction, and firmware remediation on any affected WAGO managed switch that is reachable from non-trusted networks.

Recommended defensive actions

• Inventory all WAGO 852-series managed switches and confirm exact model and firmware version before making changes.
• Upgrade each affected device to the fixed firmware version listed in the vendor/CISA advisory for that model.
• If immediate patching is not possible, disable SSH and Telnet on the device to reduce the attack vector, as recommended in the source advisory.
• Restrict management-plane access to trusted maintenance networks only and verify that remote CLI access is not broadly exposed.
• Monitor for unexpected administrative access, configuration changes, and device restarts on affected switches until remediation is complete.

Evidence notes

All substantive claims in this debrief come from the supplied CISA CSAF source item and its referenced vendor/CERT VDE materials. The advisory explicitly identifies unauthenticated remote exploitation, a hidden CLI function, root/full compromise impact, affected WAGO 852-series switch models, fixed firmware versions, and the SSH/Telnet workaround. Published date context is taken from the provided CVE/source timeline: 2026-03-23 initial publication and 2026-03-26 modification/republication.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.