CVE-2026-3587: WAGO Industrial Managed Switches CLI Escape — Detection and Remediation Guide

---
title: WAGO Switch CLI Login Access
id: 3a1b9c2d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects successful login attempts to WAGO managed switches via SSH or Telnet. While administrative access is legitimate, a spike from unexpected internal IPs may indicate scanning for CVE-2026-3587.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-085-01
author: Security Arsenal
date: 2026/02/20
tags:
  - attack.initial_access
  - attack.t1078
logsource:
  product: wago
  service: syslog
detection:
  selection:
    program|contains:
      - 'sshd'
      - 'telnetd'
    msg|contains:
      - 'Accepted'
      - 'login success'
  condition: selection
falsepositives:
  - Legitimate administrator maintenance
level: medium
---
title: WAGO Suspicious CLI Escape Sequence
id: 8c9d0e1f-2a3b-4c5d-6e7f-8a9b0c1d2e3f
status: experimental
description: Detects potential CLI escape characters or command injection often associated with jailbreaking restricted interfaces on embedded devices.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-085-01
author: Security Arsenal
date: 2026/02/20
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  product: wago
  service: syslog
detection:
  selection_keywords:
    msg|contains:
      - 'sh'
      - 'bin/bash'
      - 'exec'
  selection_separators:
    msg|contains:
      - '|'
      - ';'
      - '&&'
      - '`'
  condition: all of selection_*
falsepositives:
  - Administrator troubleshooting commands
level: high

// Hunt for WAGO Switch Management Access
let WAGO_IPs = dynamic(["192.168.10.0/24", "10.0.0.0/8"]); // Update with your OT subnets
Syslog
| where Computer in (WAGO_IPs) or ProcessName contains "sshd"
| where SyslogMessage has "Accepted" 
    or SyslogMessage has "login"
| extend DeviceModel = extract(@"852-\d+", 0, SyslogMessage)
| project TimeGenerated, Computer, ProcessName, SyslogMessage, DeviceModel, SourceIP
| order by TimeGenerated desc


// Hunt for anomalous process execution on Linux-based endpoints (if agents deployed)
DeviceProcessEvents 
| where InitiatingProcessFileName in ("sh", "bash", "dash", "busybox")
| where FileName in ("nc", "telnet", "wget", "curl")
| where DeviceType == "IoT" // Assuming IoT classification for switches
| project Timestamp, DeviceName, AccountName, FileName, CommandLine, InitiatingProcessFileName
| order by Timestamp desc

-- Hunt for connections to WAGO Switch Management Ports
SELECT Connection.RemoteAddress, Connection.RemotePort, Connection.Pid, Process.Name, Process.Cmdline
FROM watch_netstat()
WHERE Connection.RemotePort IN (22, 23, 80, 443)
  AND Connection.State = 'ESTABLISHED'
  -- Filter out known management IPs to reduce noise
  AND Connection.RemoteAddress NOT IN ('127.0.0.1', '::1')

#!/bin/bash

# WAGO Firmware Vulnerability Scanner for CVE-2026-3587
# Usage: ./scan_wago.sh <subnet> (e.g., 192.168.1)

SUBNET="$1"

if [ -z "$SUBNET" ]; then
  echo "Usage: $0 <subnet>"
  exit 1
fi

echo "Scanning subnet $SUBNET.0/24 for WAGO devices and checking firmware versions..."

# Define vulnerable hardware and minimum patched versions
# Format: "HW_MODEL:MIN_PATCHED_VERSION"
VULN_MAP=(
  "852-1812:V1.2.1.S0"
  "852-1813:V1.2.1.S0"
  "852-1816:V1.2.1.S0"
  "852-303:V1.2.8.S0"
  "852-1305:V1.2.0.S0"
  "852-1813/000-001:V1.2.3.S0"
)

check_version() {
  local hw_model="$1"
  local current_ver="$2"
  local min_ver="$3"

  # Basic string comparison (simplified for this script; real version parsing is complex)
  if [[ "$current_ver" < "$min_ver" ]]; then
    echo "[!] VULNERABLE: Firmware $current_ver is older than patched $min_ver"
  else
    echo "[+] Patched or Safe: Firmware $current_ver"
  fi
}

# Scan loop
for i in {1..254}; do
  IP="$SUBNET.$i"
  
  # Quick check if port 80 is open (simple probe)
  timeout 1 bash -c "cat < /dev/null > /dev/tcp/$IP/80" 2>/dev/null
  if [ $? -eq 0 ]; then
    # Try to fetch the device info page (common path for WAGO)
    # Note: WAGO devices often expose info at / or /cgi-bin/
    RESPONSE=$(curl -s --max-time 2 "http://$IP" | grep -oP '(?<=<title>).*?(?=</title>)' || echo "Unknown")
    
    # If response contains WAGO, try to identify model/firmware (Generic logic)
    if echo "$RESPONSE" | grep -qi "wago"; then
      echo "\nDevice Found: $IP ($RESPONSE)"
      # Actual version extraction would require specific API calls or parsing of the HTML source
      # This is a placeholder for where you would implement version parsing logic
      # e.g., curl -s http://$IP/PLC/WEBPLC/EDITPLC.htm | grep Firmware
      echo "Manual verification required for firmware version."
      echo "Refer to advisory ICSA-26-085-01 for specific hardware checks."
    fi
  fi
done

echo "\nScan complete."

Update affected devices to the following firmware versions or later: