{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/tp600--4.10.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-80466"},{"id":"CVE-2026-88850"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["CC100 (\u003c 4.10.0)","PFC100 G2 (\u003c 4.10.0)","PFC200 G2 (\u003c 4.10.0)","TP600 (\u003c 4.10.0)","Edge Controller (\u003c 4.10.0)","WP400 (\u003c 4.10.0)"],"_cs_severities":["high"],"_cs_tags":["ics","scada","vulnerability","command-injection"],"_cs_type":"advisory","_cs_vendors":["WAGO"],"content_html":"\u003cp\u003eTwo security vulnerabilities, CVE-2026-80466 and CVE-2026-88850, affect the Web-Based Management (WBM) interface of multiple WAGO hardware controllers, including the CC100, PFC100 G2, PFC200 G2, TP600, Edge Controller, and WP400 series. These devices, which run WAGO OS Linux, are widely deployed across critical infrastructure sectors such as energy, water and wastewater, and manufacturing. The flaws allow an authenticated, low-privileged remote attacker to bypass intended privilege boundaries. Specifically, insufficient input validation in the routing configuration interface allows for OS command injection, where malicious payloads are written to configuration files and subsequently executed by a root-level helper script. Additionally, a secondary vulnerability impacts the authorization model for PROFIBUS configuration management, allowing unauthorized administrative changes. Organizations using affected firmware versions (1.0.0 through 4.10.0) are at risk of complete device compromise.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains authenticated access to the Web-Based Management (WBM) interface of the WAGO controller using compromised or default credentials.\u003c/li\u003e\n\u003cli\u003eAttacker navigates to the routing configuration section of the WBM interface.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious payload containing shell metacharacters injected into a routing parameter field.\u003c/li\u003e\n\u003cli\u003eThe WBM interface fails to sanitize the input and stores the malicious payload into a persistent configuration file on the system.\u003c/li\u003e\n\u003cli\u003eA privileged root helper script periodically reads the configuration file for system updates or network synchronization.\u003c/li\u003e\n\u003cli\u003eThe root helper script interprets and executes the embedded malicious payload with root-level privileges.\u003c/li\u003e\n\u003cli\u003eThe attacker achieves arbitrary code execution as the root user, facilitating unauthorized system configuration or full control over the industrial controller.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerabilities represent a significant risk to industrial operations. Successful exploitation allows an authenticated attacker to execute arbitrary commands with root privileges on the device. Given the deployment of these controllers in critical infrastructure sectors - including energy, water, and transportation - this could lead to operational disruption, loss of control over industrial processes, or the manipulation of safety-critical parameters.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade all affected WAGO controllers to firmware version 4.10.0 (FW32) or higher immediately to address CVE-2026-80466 and CVE-2026-88850.\u003c/li\u003e\n\u003cli\u003eRestrict network access to the WBM interface to authorized management subnets only via firewall rules or physical network segmentation.\u003c/li\u003e\n\u003cli\u003eImplement VPN access for remote management to ensure that WBM interfaces are not exposed directly to the internet.\u003c/li\u003e\n\u003cli\u003eAudit access logs for the WBM interface to detect abnormal authentication patterns or attempts to modify routing and PROFIBUS configurations by non-administrative users.\u003c/li\u003e\n\u003cli\u003eReview device manuals (specifically Sections 6 and 7 regarding security and VPN recommendations) for further hardening guidance provided by the vendor.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-20T17:31:34Z","date_published":"2026-10-20T17:31:34Z","id":"https://feed.craftedsignal.io/briefs/2026-10-wago-os-linux/","summary":"Multiple vulnerabilities in WAGO industrial controller firmware allow an authenticated low-privileged user to achieve root-level OS command injection and bypass configuration authorization checks.","title":"WAGO OS Linux: Web-Based Management OS command injection (CVE-2026-80466, CVE-2026-88850)","url":"https://feed.craftedsignal.io/briefs/2026-10-wago-os-linux/"}],"language":"en","title":"CraftedSignal Threat Feed - TP600 (\u003c 4.10.0)","version":"https://jsonfeed.org/version/1.1"}