Description
User credentials are stored using AES‑ECB encryption with a hardcoded key. An unauthenticated remote attacker obtaining the configuration file can decrypt and recover plaintext usernames and passwords, especially when combined with the authentication bypass.
Published: 2026-02-09
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 10 Feb 2026 12:45:00 +0000

Type Values Removed Values Added
First Time appeared Wago
Wago 0852-1322
Wago 0852-1328
Vendors & Products Wago
Wago 0852-1322
Wago 0852-1328

Mon, 09 Feb 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 09 Feb 2026 08:00:00 +0000

Type Values Removed Values Added
Description User credentials are stored using AES‑ECB encryption with a hardcoded key. An unauthenticated remote attacker obtaining the configuration file can decrypt and recover plaintext usernames and passwords, especially when combined with the authentication bypass.
Title Hardcoded Key Allows Credential Disclosure
Weaknesses CWE-321
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Wago 0852-1322 0852-1328
cve-icon MITRE

Status: PUBLISHED

Assigner: CERTVDE

Published:

Updated: 2026-02-09T15:31:17.549Z

Reserved: 2026-01-13T08:33:25.684Z

Link: CVE-2026-22906

cve-icon Vulnrichment

Updated: 2026-02-09T15:30:59.187Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-02-09T08:16:11.723

Modified: 2026-02-09T16:08:35.290

Link: CVE-2026-22906

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-02-10T12:23:49Z

Weaknesses