Loading vulnerability…
Hidden CLI Function Escape in WAGO Managed Switches
CVE-2026-3587 is a critical vulnerability in multiple WAGO Lean Managed Switch and Industrial Managed Switch products. The issue is caused by hidden functionality in the device CLI prompt that can be abused by an unauthenticated remote attacker to escape the intended restricted management interface. According to the provided context, successful exploitation allows the attacker to break out of the restricted CLI environment, gain root access to the underlying Linux-based operating system, and fully compromise the device. The vulnerability is remotely reachable over the network and requires no authentication or user interaction.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation provides complete compromise of the affected switch. An attacker can obtain root-level access to the underlying Linux OS, which implies full control over the device, including the ability to alter configuration, disrupt switching or management functions, access sensitive data present on the device, and use the device as a foothold for further activity in the operational or enterprise network. The provided CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) indicates high impact to confidentiality, integrity, and availability.
If you can’t patch tonight, do this now.
Until firmware updates can be applied, disable SSH and Telnet management access to remove or reduce the remote attack surface. The vendor specifically advised disabling SSH and Telnet on Lean Managed Switch models to eliminate the attack vector, and disabling SSH and Telnet on Industrial Managed Switch models to reduce the attack vector while keeping CLI access local via RS232 where supported. Restrict management-plane network exposure as much as operationally possible.
Patch, then assume compromise.
Apply the vendor-fixed firmware versions for affected models. The provided context states the following fixed releases: V1.2.1.S1 for Lean Managed Switch models 852-1812, 852-1813, 852-1816, 852-1812/010-000, 852-1813/010-000, 852-1816/010-000, and 852-1813/010-001; V1.2.3.S1 for Lean Managed Switch 852-1813/000-001; V1.2.8.S1 for Industrial Managed Switch 852-303; V1.2.0.S1 for Industrial Managed Switch 852-1305, 852-1305/000-001, and 852-1505/000-001; V1.1.9.S1 for Industrial Managed Switch 852-1505; V1.0.6.S1 for Industrial Managed Switch 852-602 and 852-603; and V1.2.5.S1 for Industrial Managed Switch 852-1605. Firmware versions prior to these releases are stated to be affected.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.