PT-2026-7082 · Wago · Wago 0852-1322

Diconium · Published 2026-02-09 · Updated 2026-03-22 · CVE-2026-22904

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions lighttpd (affected versions not specified) WAGO 0852-1322 (affected versions not specified)

Description An issue exists where improper length handling during the parsing of multiple cookie fields, including the TRACKID field, can allow an unauthenticated remote attacker to send oversized cookie values. This can trigger a stack buffer overflow, potentially leading to a denial-of-service condition and possible remote code execution. The vulnerability affects devices that process cookies without proper size validation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

RCE

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

CVE-2026-22904

Affected Products

Wago 0852-1322

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2026-22904 · Security Note
• https://twitter.com/TheHackerWire/status/2020775461480288264 · Twitter Post
• https://twitter.com/offseq/status/2020807447418437801 · Twitter Post
• https://twitter.com/PurpleOps_io/status/2021094750640607256 · Twitter Post
• https://twitter.com/PurpleOps_io/status/2021094665684988137 · Twitter Post
• https://t.me/CVEtracker/44185 · Telegram Post
• https://twitter.com/CVEnew/status/2020768412109099491 · Twitter Post
• https://twitter.com/TheRabbitPy/status/2035785842371772856 · Twitter Post
• https://certvde.com/de/advisories/VDE-2026-004 · Note
• https://t.me/cveNotify/151374 · Telegram Post
• https://twitter.com/CveFindCom/status/2020787630258999750 · Twitter Post