---
id: CVE-2025-41732
title: >-
  An unauthenticated remote attacker can abuse unsafe sscanf calls within the
  check_cookie() function to write arbitrary data into fixed-size stack buffers
  which leads to full device compromise.
summary: >-
  An unauthenticated remote attacker can abuse unsafe sscanf calls within the
  check_cookie() function to write arbitrary data into fixed-size stack buffers
  which leads to full device compromise.
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-121
  - CWE-787
vendor: wago
product: 0852-1328_firmware
affected:
  - 0852-1328_firmware < 02.64
  - 0852-1322_firmware < 02.64
patched:
  - 0852-1328_firmware 02.64
  - 0852-1322_firmware 02.64
published: '2025-12-10'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T23:10:00.463'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-41732'
references:
  - url: 'https://certvde.com/de/advisories/VDE-2025-095'
    label: info@cert.vde.com
tags:
  - nvd
epss: 0.00429
epssPercentile: 0.34549
ingestedAt: '2026-09-25T23:21:16.914Z'
---

## Overview

An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_cookie() function to write arbitrary data into fixed-size stack buffers which leads to full device compromise.

## Affected

- `0852-1328_firmware < 02.64`
- `0852-1322_firmware < 02.64`

## Remediation

Upgrade past the affected range:

- `0852-1328_firmware 02.64`
- `0852-1322_firmware 02.64`