WAGO Switches 2038 Year Problem Vulnerability (CVE-2025-1235) Advisory

Critical Vulnerability Information Vulnerability ID VDE-2025-020 Release and Update Time Release Time: 2025-06-02 08:00 (CEST) Last Update Time: 2025-06-02 08:04 (CEST) Affected Vendors and Products Vendor: WAGO GmbH & Co. KG Affected Products and Versions: - Fully Managed Switches 0852-0303: All versions - Fully Managed Switches 0852-1305: All versions - Fully Managed Switches 0852-1305/0000-0001: All versions - Fully Managed Switches 0852-1505: All versions - Fully Managed Switches 0852-1505/0000-0001: All versions - Lean Managed Switches 0852-1812: All versions - Lean Managed Switches 0852-1812/0010-0000: All versions - Lean Managed Switches 0852-1813: All versions - Lean Managed Switches 0852-1813/0000-0001: All versions - Lean Managed Switches 0852-1813/0010-0000: All versions - Lean Managed Switches 0852-1813/0010-0001: All versions - Lean Managed Switches 0852-1816: All versions - Lean Managed Switches 0852-1816/0010-0000: All versions Vulnerability Overview The Year 2038 problem affects systems that use 32-bit integers to represent the number of seconds since January 1, 1970. On January 19, 2038, at 03:14:07 UTC, the time value will exceed the maximum value of a 32-bit integer, causing an overflow and resetting to a negative number. CVE ID CVE-2025-1235 Last Update Time April 25, 2025, 10:28 AM Severity 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Weakness Integer Overflow or Wraparound (CWE-190) Summary A low-privileged attacker can set the device date to January 19, 2038, exceeding the 32-bit time limit. This will cause the switch's date to reset to January 1, 1970. Impact This will result in the system time being reset and affect the timestamps in system logs. Solution Due to the low impact of the vulnerability and its limited effect on logging functionality, no fix is currently planned. Reporter CERT@VDE coordinating with Wago Reporter: Marcus Kramhöller from Noris Automatik GmbH

Goal Reached Thanks to every supporter — we hit 100%!

WAGO Switches 2038 Year Problem Vulnerability (CVE-2025-1235) Advisory