CVE-2026-22904
Stack Buffer Overflow in Cookie Parsing Causes DoS, RCE
Publication date: 2026-02-09
Last updated on: 2026-02-09
Assigner: CERT VDE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wago | 852-1328 | to 2.65 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-121 | A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves improper length handling when parsing multiple cookie fields, including TRACKID. An unauthenticated remote attacker can send oversized cookie values that trigger a stack buffer overflow.
This overflow can cause a denial-of-service condition and may also allow the attacker to execute remote code on the affected system.
How can this vulnerability impact me? :
Exploitation of this vulnerability can lead to a denial-of-service condition, making the affected service unavailable.
More severely, it may allow remote attackers to execute arbitrary code on the system without authentication, potentially compromising system integrity, confidentiality, and availability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
The CVE description indicates that the vulnerability is due to improper length handling of multiple cookie fields, leading to a stack buffer overflow. While no direct mitigation steps are provided in the context or resources, general immediate steps for such vulnerabilities include limiting or filtering oversized cookie values at the network perimeter or web server level, and applying any available patches or updates from the vendor.
Resource 1 mentions a related vulnerability in a similar device that is remediated by updating the firmware to version 02.65. Although it is for a different CVE, this suggests that checking for and applying firmware or software updates from the vendor is a recommended mitigation approach.