Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 6

Export CSV
CVE-2026-22903

Stack Overflow via SESSIONID Cookie in lighttpd

An unauthenticated remote attacker can send a crafted HTTP request containing an overly long SESSIONID cookie. This can trigger a stack buffer overflow in the modified lighttpd server, causing it to crash and potentially enabling remote code execution due to missing stack protections.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Wago
Products
0852-1322 0852-1328
CVE-2026-22904

Stack Overflow via Oversized Cookie Fields in lighttpd

Improper length handling when parsing multiple cookie fields (including TRACKID) allows an unauthenticated remote attacker to send oversized cookie values and trigger a stack buffer overflow, resulting in a denial‑of‑service condition and possible remote code execution.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Wago
Products
0852-1322 0852-1328
CVE-2026-22905

Authentication Bypass via URI Traversal

An unauthenticated remote attacker can bypass authentication by exploiting insufficient URI validation and using path traversal sequences (e.g., /js/../cgi-bin/post.cgi), gaining unauthorized access to protected CGI endpoints and configuration downloads.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Wago
Products
0852-1322 0852-1328
CVE-2026-22906

Hardcoded Key Allows Credential Disclosure

User credentials are stored using AES‑ECB encryption with a hardcoded key. An unauthenticated remote attacker obtaining the configuration file can decrypt and recover plaintext usernames and passwords, especially when combined with the authentication bypass.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Wago
Products
0852-1322 0852-1328
CVE-2025-41732

Stack-based buffer overflow via unsafe sscanf in check_cookie()

An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_cookie() function to write arbitrary data into fixed-size stack buffers which leads to full device compromise.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Wago
Products
0852-1322 0852-1322 Firmware 0852-1328 and 2 more
CVE-2025-41730

Stack-based buffer overflow via unsafe sscanf in check_account()

An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_account() function to write arbitrary data into fixed-size stack buffers which leads to full device compromise.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Wago
Products
0852-1322 0852-1322 Firmware 0852-1328 and 2 more