{"id":"CVE-2026-3587","aliases":["EUVD-2026-14385","GHSA-4r7q-86hg-h98x"],"status":"published","title":"Hidden CLI Function Allows Root Access","description":"An unauthenticated remote attacker can exploit a hidden function in the CLI prompt to escape the restricted interface, leading to full compromise of the device.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00706,"percentile":0.53657,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-912"],"published":"2026-03-23T07:49:17Z","modified":"2026-06-17T10:43:49Z","products":[{"vendor":"wago","product":"industrial managed switch 852-1305"},{"vendor":"wago","product":"industrial managed switch 852-1305-000-001"},{"vendor":"wago","product":"industrial managed switch 852-1505"},{"vendor":"wago","product":"industrial managed switch 852-1505-000-001"},{"vendor":"wago","product":"industrial managed switch 852-1605"},{"vendor":"wago","product":"industrial managed switch 852-303"},{"vendor":"wago","product":"industrial managed switch 852-602"},{"vendor":"wago","product":"industrial managed switch 852-603"},{"vendor":"wago","product":"lean managed switch 852-1812"},{"vendor":"wago","product":"lean managed switch 852-1812-010-000"},{"vendor":"wago","product":"lean managed switch 852-1813"},{"vendor":"wago","product":"lean managed switch 852-1813-000-001"},{"vendor":"wago","product":"lean managed switch 852-1813-010-000"},{"vendor":"wago","product":"lean managed switch 852-1813/010-001"},{"vendor":"wago","product":"lean managed switch 852-1816"},{"vendor":"wago","product":"lean managed switch 852-1816-010-000"}],"references":[{"url":"https://certvde.com/de/advisories/VDE-2026-020"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3587"},{"url":"https://github.com/advisories/GHSA-4r7q-86hg-h98x"}],"sources":{"cve":[{"id":"CVE-2026-3587","title":"Hidden CLI Function Allows Root Access","description":"An unauthenticated remote attacker can exploit a hidden function in the CLI prompt to escape the restricted interface, leading to full compromise of the device.","status":"published","published":"2026-03-23T07:49:17.325Z","modified":"2026-03-24T07:38:36.602Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-912"],"updated_at":"2026-11-02T13:49:09.229322Z"}],"euvd":[{"id":"EUVD-2026-14385","description":"An unauthenticated remote attacker can exploit a hidden function in the CLI prompt to escape the restricted interface, leading to full compromise of the device.","status":"published","published":"2026-03-23T07:49:17Z","modified":"2026-03-24T07:38:36Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:25:30.317985Z"}],"ghsa":[{"id":"GHSA-4r7q-86hg-h98x","title":"An unauthenticated remote attacker can exploit a hidden function in the CLI prompt to escape the...","description":"An unauthenticated remote attacker can exploit a hidden function in the CLI prompt to escape the restricted interface and gain root access to the underlying Linux based OS, leading to full compromise of the device.","status":"published","published":"2026-03-23T09:30:29Z","modified":"2026-03-23T09:30:29Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-912"],"updated_at":"2026-11-02T15:06:47.740951Z"}],"nvd":[{"id":"CVE-2026-3587","description":"An unauthenticated remote attacker can exploit a hidden function in the CLI prompt to escape the restricted interface, leading to full compromise of the device.","status":"published","published":"2026-03-23T08:16:17.36Z","modified":"2026-06-17T10:43:49.597Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-912"],"updated_at":"2026-11-02T14:12:10.568062Z"}]}}