An unauthenticated remote attacker can bypass authentication by exploiting insufficient URI validation and employing path traversal sequences such as /js/../cgi-bin/post.cgi, which allows unauthorized access to protected CGI endpoints and configuration downloads. This flaw can lead to the exposure of sensitive configuration data and potentially to unauthorized manipulation of device settings, posing a significant security risk.

The vulnerability affects WAGO devices in the 0852‑1322 and 0852‑1328 series. No specific firmware or revision numbers are listed, so all current deployments of these series are potentially impacted.

The CVSS score of 7.5 indicates a high severity vulnerability, and the EPSS score of less than 1% shows a very low exploitation probability at present. The flaw is not listed in the CISA KEV catalog. The likely attack vector is remote, unauthenticated, and requires the attacker to send a specially crafted request to the device’s web interface, bypassing authentication and accessing configuration resources.