WAGO GmbH & Co. KG Industrial Managed Switches

A critical vulnerability (CVE-2026-3587) with CVSS score 10.0 affects WAGO Industrial Managed Switches across multiple firmware versions. The vulnerability allows unauthenticated remote attackers to exploit a hidden function in the CLI prompt to escape the restricted interface, leading to full device compromise. The flaw impacts critical infrastructure sectors including energy, transportation, and manufacturing. WAGO has released firmware updates to address the vulnerability and recommends disabling SSH/telnet access as a mitigation. No known public exploitation has been reported to CISA at this time.