The vulnerability is caused by improper length handling when parsing multiple cookie fields, including TRACKID, in the lighttpd web server. An unauthenticated attacker can send oversized cookie values that overflow a stack buffer, which can lead to a denial‑of‑service and, in the worst case, allow remote code execution. This flaw is identified as a stack-based buffer overflow (CWE‑121).

The affected systems are devices manufactured by WAGO, specifically model series 0852‑1322 and 0852‑1328. No specific firmware or software versions are listed in the vendor advisory, so all current releases of these models that incorporate the vulnerable lighttpd component are potentially impacted.

The CVSS score of 9.8 indicates a critical level of severity, while the EPSS score of less than 1% suggests that the probability of exploitation at this time is low. The vulnerability is not yet listed in the CISA Known Exploited Vulnerabilities catalog. Based on the description, the likely attack vector is over the network: an attacker crafts an HTTP request containing oversized cookie fields and sends it to the affected lighttpd instance. No authentication is required, so the threat can be launched remotely against any system that is reachable and is using the vulnerable software component. This makes the risk high, especially if the device is exposed to the internet or an untrusted network.