« Volver al listado

CVE-2026-22906

Estado: AplazadaCrítica (9.8)—

User credentials are stored using AES‑ECB encryption with a hardcoded key. An unauthenticated remote attacker obtaining the configuration file can decrypt and recover plaintext usernames and passwords, especially when combined with the authentication bypass.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:N/PR:N/UI:N indica red sin autenticación (T1190). Recuperación de credenciales por descifrado de archivo de configuración (CWE-321, clave hardcodeada) es T1212; acceso con esas credenciales es T1078.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Application Developer GuidancePrivileged Account ManagementApplication Isolation and SandboxingExploit ProtectionUpdate SoftwareActive Directory Configuration

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-22906",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-22906",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-09T15:29:06.439394Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "info@cert.vde.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "info@cert.vde.com",
      "affectedData": [
        {
          "vendor": "WAGO",
          "product": "0852-1322",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "2.64"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "WAGO",
          "product": "0852-1328",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "2.64"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "WAGO",
          "product": "0852-1322",
          "versions": [
            {
              "status": "affected",
              "version": "2.64"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "WAGO",
          "product": "0852-1328",
          "versions": [
            {
              "status": "affected",
              "version": "2.64"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-02-09T08:16:11.723",
  "references": [
    {
      "url": "https://certvde.com/de/advisories/VDE-2026-004",
      "source": "info@cert.vde.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "info@cert.vde.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-321"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "User credentials are stored using AES‑ECB encryption with a hardcoded key. An unauthenticated remote attacker obtaining the configuration file can decrypt and recover plaintext usernames and passwords, especially when combined with the authentication bypass."
    },
    {
      "lang": "es",
      "value": "Las credenciales de usuario se almacenan utilizando cifrado AES?ECB con una clave codificada de forma rígida. Un atacante remoto no autenticado que obtenga el archivo de configuración puede descifrar y recuperar nombres de usuario y contraseñas en texto plano, especialmente cuando se combina con la omisión de autenticación."
    }
  ],
  "lastModified": "2026-06-17T10:20:35.613",
  "sourceIdentifier": "info@cert.vde.com"
}