WAGO industrial managed switches exposed to critical hidden-CLI flaw (CVE-2026-3587)

Photo by protect.computer (custom explainer graphic) on protect.computer

What happened

CISA published ICS advisory ICSA-26-085-01 for CVE-2026-3587 affecting multiple WAGO industrial managed switch models and firmware versions.

The advisory states that an unauthenticated remote attacker can abuse a hidden function in the CLI prompt to escape the restricted interface, which can lead to full device compromise.

NVD tracks the same issue and maps weakness CWE-912 (Hidden Functionality).

Why this matters

These are industrial networking devices. If a threat actor compromises edge switching in OT/ICS environments, the blast radius can include:

traffic interception/manipulation,
segmentation bypass,
lateral movement into control environments,
operational disruption.

This is especially urgent for internet-reachable or weakly segmented management interfaces.

How to check if you’re affected

Potentially affected systems/services

WAGO industrial managed switches listed in CISA ICSA-26-085-01.
Devices running firmware versions below the fixed baselines documented by vendor/CISA.
Deployments exposing device management/CLI surfaces to untrusted networks.

Concrete verification steps (10–20 minute triage)

Inventory exact hardware + firmware versions
- Export your switch asset list and firmware versions.
- Match against affected/fixed versions in CISA and CERT@VDE advisories.
Check management-plane exposure
- Confirm which management interfaces are reachable from IT networks, vendor remote-access paths, or internet edges.
- Block any unnecessary external access immediately.
Apply vendor-recommended firmware updates
- Upgrade affected devices to fixed firmware versions per model.
- Validate successful update and post-upgrade config integrity.
Hunt for suspicious admin/CLI activity
- Review switch/system logs for unknown sessions, unusual command sequences, and unexplained config changes.
- Investigate abnormal routing/VLAN/ACL changes.
Strengthen compensating controls
- Enforce strict ACLs for management access.
- Isolate OT management networks and require strong authentication paths (jump host/VPN/MFA where possible).

Immediate defensive actions

Patch affected WAGO devices on an expedited timeline.
Restrict management access to trusted admin segments only.
Audit switch configurations for unauthorized changes after remediation.

Sources

Bottom line

Treat CVE-2026-3587 as an urgent OT network-hardening item: identify affected WAGO switches, patch quickly, and lock down management-plane reachability before it becomes an initial access path.