An unauthenticated attacker can send a specially crafted HTTP request containing an excessively large SESSIONID cookie to a modified lighttpd server. The request triggers a stack buffer overflow that causes the server to crash. Because the server lacks sufficient stack protections, the overflow may allow the attacker to execute arbitrary code on the host.

The affected devices are WAGO controllers with firmware code numbers 0852-1322 and 0852-1328. No specific firmware version ranges have been disclosed; the flaw exists in the modified lighttpd server component used across these products.

The vulnerability has a CVSS score of 9.8, indicating critical severity. The EPSS score is below 1 %, suggesting low current exploitation likelihood, but the impact remains high. The flaw is not listed in the CISA KEV catalog. The attack vector is remote over the network, exploiting the HTTP interface without authentication, and feasibility depends on the availability of the vulnerable web server and lack of stack protection mechanisms.