This vulnerability arises from a hidden command in the command line interface that, when invoked, unexpectedly removes the restrictions normally defined for the interface. Because the function can be triggered without authentication, a remote attacker who can reach the device can use it to gain full administrative privileges, effectively achieving arbitrary code execution and compromising the device and any network services it provides. The weakness corresponds to the logic‑based bypass described by CWE‑912.

All WAGO Industrial and Lean Managed Switch models enumerated in the CNA list, including the 852‑1305 series, 852‑1505 series, 852‑1605, 852‑303, 852‑602, 852‑603, 852‑1812, 852‑1813, and 852‑1816, along with their variant identifiers such as 852‑1305‑000‑001 and 852‑1813‑010‑001.

The CVSS score of 10 indicates maximum severity, while the EPSS score of less than 1% suggests that, so far, exploitation is uncommon but possible. The likely attack vector is remote network access to the device’s CLI, giving an unauthenticated attacker the ability to invoke the hidden command. Although the vulnerability is not listed in the CISA KEV catalog, its high severity and the lack of an authentication barrier mean it should be treated with the utmost urgency.