Two Vulnerabilities in WAGO OS Linux Firmware Allow Privilege Escalation
CISA alerts to two vulnerabilities in WAGO OS Linux firmware affecting multiple industrial devices, enabling low-privileged users to bypass security controls.
CISA has issued an advisory detailing two critical vulnerabilities within the Web-Based Management (WBM) interface of WAGO OS Linux firmware. These flaws, identified as CVE-2026-80466 and CVE-2026-88850, affect multiple WAGO device models, including CC100, PFC100 G2, PFC200 G2, TP600, Edge Controller, and WP400 series, running firmware versions 1.0.0 through 4.9.9.
The vulnerabilities allow an authenticated user with low privileges to bypass intended security boundaries within the WBM interface. This bypass impacts two key areas: the routing configuration functionality and the authorization model for PROFIBUS configuration management. Exploitation could lead to unauthorized modifications of network routing or improper access to sensitive PROFIBUS settings.
CVE-2026-80466 specifically involves an improper neutralization of special elements used in an OS command, commonly known as OS Command Injection. A low-privileged remote attacker can inject shell commands into routing parameters. Due to insufficient input validation, these commands are stored in a configuration file and subsequently processed by a privileged root helper script, granting the attacker elevated permissions.
CVE-2026-88850 relates to a missing authorization flaw. While the exact technical details are less elaborated in the advisory, it contributes to the overall ability of a low-privileged user to escalate their privileges and gain unauthorized access to critical system configurations, particularly concerning PROFIBUS management.
These vulnerabilities pose a significant risk to industrial control systems (ICS) and operational technology (OT) environments. WAGO devices are deployed globally across critical infrastructure sectors, including Chemical, Critical Manufacturing, Commercial Facilities, Energy, Transportation Systems, and Water and Wastewater Systems. The ability for an attacker to manipulate routing or PROFIBUS configurations could disrupt operations, lead to data breaches, or cause physical damage.
WAGO has acknowledged the vulnerabilities and recommends that users update their firmware to Version 4.10.0 (FW32) or higher. For the most current custom firmware, users are advised to contact WAGO support directly. Additionally, WAGO provides general security recommendations in the manuals for its Controller PFC100/PFC200 products, emphasizing physical access restrictions and the use of VPNs for secure remote access.
Further mitigation guidance can be found in WAGO's security advisories and through their Product Security Incident Response Team (PSIRT). The company has also published a security advisory (VDE-2026-096) detailing these issues. The CVSS score for these vulnerabilities is rated at 8.8, indicating a high severity level.
Organizations utilizing affected WAGO devices should prioritize applying the recommended firmware updates and implementing the security best practices outlined by WAGO to protect their industrial networks from potential exploitation.