CVE-2025-41732
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-12-10

Last updated on: 2025-12-11

Assigner: CERT VDE

Description
An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_cookie() function to write arbitrary data into fixed-size stack buffers which leads to full device compromise.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-10
Last Modified
2025-12-11
Generated
2026-05-07
AI Q&A
2025-12-10
EPSS Evaluated
2026-05-05
NVD
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
wago industrial-managed_switch 2.64
lighttpd lighttpd *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability is a critical stack-based buffer overflow in WAGO Industrial-Managed Switches caused by unsafe sscanf calls within the check_cookie() function of the lighttpd binary. An unauthenticated remote attacker can exploit this flaw to write arbitrary data into fixed-size stack buffers, leading to full device compromise. The affected binary lacks modern security protections, making exploitation easier. [1]


How can this vulnerability impact me? :

Exploitation of this vulnerability can result in full device compromise, allowing remote code execution or denial of service. This includes the possibility of disabling the device's web interface without automatic recovery, potentially disrupting device operation and network management. [1]


How can this vulnerability be detected on my network or system? Can you suggest some commands?

Detection can be performed by identifying devices running vulnerable firmware versions earlier than 02.64 on WAGO Industrial-Managed Switches models 0852-1322 and 0852-1328. Since the vulnerability involves the lighttpd binary's check_cookie() function, monitoring HTTP requests for unusual or malformed cookies that might trigger the unsafe sscanf calls could help. However, no specific detection commands are provided in the available resources. [1]


What immediate steps should I take to mitigate this vulnerability?

The immediate mitigation step is to update the device firmware to version 02.64 or later, which addresses the vulnerability. Until the update can be applied, restricting access to the affected devices' web interfaces and monitoring for suspicious activity is advisable to reduce risk. [1]


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart