CVE-2026-2328
An unauthenticated remote attacker can exploit insufficient input validation to access backend components beyond their intended scope via path traversal, resulting in exposure of sensitive information.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS probability
- 0.31%
- CWE
- CWE-790
- Published
- 2026-03-30
- Last modified
- 2026-03-30
Affected products
- WAGO Device Sphere
- WAGO Solution Builder
Weakness type
Related vulnerabilities
- CVE-2026-11331 — Potential wildcard CNAME RPZ policy bypass
- CVE-2026-9658 — Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths
- CVE-2025-27260 — Ericsson Indoor Connect 8855 - Improper Filtering of Special Elements Vulnerability
- CVE-2025-15576 — Jail chroot escape via fd exchange with a different jail
- CVE-2025-0431 — Enterprise Protection Backslash URL Rewrite Bypass
- CVE-2024-47984 — Dell RecoverPoint for Virtual Machines 6.0.x contains Denial of Service vulnerability. A User with...
- CVE-2024-42416 — Multiple issues in ctl(4) CAM Target Layer
- CVE-2024-43443 — Stored XSS in process management