WAGO: Switches affected by year 2k38 problem

4.3 CVSS

Vulnerability Description

A low privileged attacker can set the date of the devices to the 19th of January 2038 an therefore exceed the 32-Bit time limit. This causes the date of the switch to be set back to January 1st, 1970.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-1235

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Marcus Kramhöller from Noris Automatio GmbH

References

https://cert.vde.com/en/advisories/VDE-2025-020

More from WAGO

View All →

CVE-2025-41732

Stack-based buffer overflow via unsafe sscanf in check_cookie()

Critical 9.8

CVE-2025-41730

Stack-based buffer overflow via unsafe sscanf in check_account()

Critical 9.8

CVE-2025-41716

Unauthenticated User Enumeration via Missing Authentication

Medium 5.3

CVE-2025-41715

Missing Authentication for Database Access in Web Application

Critical 9.8

CVE-2025-41713

WAGO: Vulnerability in hardware switch circuit

Medium 6.5

Affected Vendor

WAGO

View all reports →

Affected Software

Fully Managed Switches 0852-0303, Fully Managed Switches 0852-1305, Fully Managed Switches 0852-1305/0000-0001, Fully Managed Switches 0852-1505, Fully Managed Switches 0852-1505/0000-0001, Lean Managed Switches 0852-1812, Lean Managed Switches 0852-1812/0010-0000, Lean Managed Switches 0852-1813, Lean Managed Switches 0852-1813/0000-0001, Lean Managed Switches 0852-1813/0010-0000, Lean Managed Switches 0852-1813/0010-0001, Lean Managed Switches 0852-1816, Lean Managed Switches 0852-1816/0010-0000

Vulnerable Versions:

all