CVE-2026-22903

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An unauthenticated remote attacker can send a crafted HTTP request containing an overly long SESSIONID cookie. This can trigger a stack buffer overflow in the modified lighttpd server, causing it to crash and potentially enabling remote code execution due to missing stack protections.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121

Affected software

VendorProductVersions
WAGO0852-1322>= 0.0.0, <= 2.64
WAGO0852-1328>= 0.0.0, <= 2.64
WAGO0852-13222.64
WAGO0852-13282.64

References

Timeline

Published
Feb 9, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-229049.8Improper length handling when parsing multiple cookie fields (including TRACKID) allows an unauthenticated remote attacker to send oversizedCVE-2026-229057.5An unauthenticated remote attacker can bypass authentication by exploiting insufficient URI validation and using path traversal sequences (eCVE-2026-229069.8User credentials are stored using AES‑ECB encryption with a hardcoded key. An unauthenticated remote attacker obtaining the configuration fiCVE-2026-229079.1An attacker may gain unauthorized access to the host filesystem, potentially allowing them to read and modify system data.CVE-2026-229089.1Uploading unvalidated container images may allow remote attackers to gain full access to the system, potentially compromising its integrity CVE-2026-229099.1Certain system functions may be accessed without proper authorization, allowing attackers to start, stop, or delete installed applications, CVE-2026-22917.3dnsmasqs extract_name() function can be abused to cause a heap buffer overflow, allowing an attacker to inject false DNS cache entries, whicCVE-2026-229109.1The device is deployed with weak and publicly known default passwords for certain hidden user levels, increasing the risk of unauthorized acCVE-2026-229117.5Firmware update files may expose password hashes for system accounts, which could allow a remote attacker to recover credentials and gain unCVE-2026-229126.1Improper validation of a login parameter may allow attackers to redirect users to malicious websites after authentication. This can lead to CVE-2026-229136.1Improper handling of a URL parameter may allow attackers to execute code in a user's browser after login. This can lead to the extraction ofCVE-2026-229146.5An attacker with limited permissions may still be able to write files to specific locations on the device, potentially leading to system man
CVE-2026-22903: Critical severity, CVSS 9.8 | Vulnix