PT-2026-7084 · Wago · Wago 0852-1322

Diconium · Publicado 2026-02-09 · Atualizado 2026-03-22 · CVE-2026-22906

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions WAGO 0852-1322 (affected versions not specified)

Description User credentials are stored using AES-ECB encryption with a hardcoded key. An unauthenticated remote attacker obtaining the configuration file can decrypt and recover plaintext usernames and passwords. This is especially concerning when combined with an authentication bypass. The issue poses a critical cybersecurity risk, particularly for organizations in the European Union's industrial sector.

Recommendations Restrict access to the configuration file. Monitor for unauthorized access attempts. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-321

Identificadores relacionados

BDU:2026-01721

CVE-2026-22906

Produtos afetados

Wago 0852-1322

Referências · 11

• https://twitter.com/TheHackerWire/status/2020775560134447358 · Publicação no Twitter
• https://certvde.com/de/advisories/VDE-2026-004 · Nota
• https://twitter.com/CveFindCom/status/2020787598122275001 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2020768410326438135 · Publicação no Twitter
• https://t.me/cveNotify/151376 · Publicação no Telegram
• https://twitter.com/TheRabbitPy/status/2035806254568784134 · Publicação no Twitter
• https://t.me/CVEtracker/44187 · Publicação no Telegram
• https://twitter.com/offseq/status/2020784781617770972 · Publicação no Twitter
• https://twitter.com/vuln_tracker/status/2022862852705370572 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-22906 · Nota de Segurança
• https://bdu.fstec.ru/vul/2026-01721 · Nota de Segurança