The vulnerability arises from the use of AES‑ECB mode with a hardcoded key to encrypt user credentials stored in the configuration file. Because the key is fixed and publicly known, an attacker who obtains the file can decrypt it and recover plaintext usernames and passwords. When the same device also has an authentication bypass that permits unauthenticated access, the attacker can combine these weaknesses to compromise the device's identity layer.

The affected devices are WAGO industrial automation controllers with product identifiers 0852‑1322 and 0852‑1328. These models ship with the described configuration storage mechanism and are susceptible to the credential disclosure flaw.

The CVSS score of 9.8 indicates a critical impact, while the EPSS score of less than 1% suggests a low probability of exploitation today, though the vulnerability remains present. The flaw is not listed in KEV, but attackers can target the devices by remotely downloading the configuration file—an operation that is possible when the device's network interface allows unauthenticated access—then applying the known hardcoded key to decrypt credentials. If the device also suffers from the authentication bypass, the attacker can gain full control without first authenticating.