PT-2026-7082 · Wago · Wago 0852-1322

Diconium · Publicado 2026-02-09 · Atualizado 2026-03-22 · CVE-2026-22904

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions lighttpd (affected versions not specified) WAGO 0852-1322 (affected versions not specified)

Description An issue exists where improper length handling during the parsing of multiple cookie fields, including the TRACKID field, can allow an unauthenticated remote attacker to send oversized cookie values. This can trigger a stack buffer overflow, potentially leading to a denial-of-service condition and possible remote code execution. The vulnerability affects devices that process cookies without proper size validation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

RCE

Stack Overflow

Enumeração de Fraquezas

CWE-121

Identificadores relacionados

CVE-2026-22904

Produtos afetados

Wago 0852-1322

Referências · 11

• https://twitter.com/TheHackerWire/status/2020775461480288264 · Publicação no Twitter
• https://twitter.com/offseq/status/2020807447418437801 · Publicação no Twitter
• https://twitter.com/PurpleOps_io/status/2021094750640607256 · Publicação no Twitter
• https://twitter.com/PurpleOps_io/status/2021094665684988137 · Publicação no Twitter
• https://t.me/CVEtracker/44185 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-22904 · Nota de Segurança
• https://twitter.com/CVEnew/status/2020768412109099491 · Publicação no Twitter
• https://twitter.com/TheRabbitPy/status/2035785842371772856 · Publicação no Twitter
• https://certvde.com/de/advisories/VDE-2026-004 · Nota
• https://t.me/cveNotify/151374 · Publicação no Telegram
• https://twitter.com/CveFindCom/status/2020787630258999750 · Publicação no Twitter