WP400 (< 4.10.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/wp400--4.10.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 20 Oct 2026 17:31:34 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgWAGO OS Linux: Web-Based Management OS command injection (CVE-2026-80466, CVE-2026-88850)https://feed.craftedsignal.io/briefs/2026-10-wago-os-linux/Tue, 20 Oct 2026 17:31:34 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-wago-os-linux/Multiple vulnerabilities in WAGO industrial controller firmware allow an authenticated low-privileged user to achieve root-level OS command injection and bypass configuration authorization checks.Two security vulnerabilities, CVE-2026-80466 and CVE-2026-88850, affect the Web-Based Management (WBM) interface of multiple WAGO hardware controllers, including the CC100, PFC100 G2, PFC200 G2, TP600, Edge Controller, and WP400 series. These devices, which run WAGO OS Linux, are widely deployed across critical infrastructure sectors such as energy, water and wastewater, and manufacturing. The flaws allow an authenticated, low-privileged remote attacker to bypass intended privilege boundaries. Specifically, insufficient input validation in the routing configuration interface allows for OS command injection, where malicious payloads are written to configuration files and subsequently executed by a root-level helper script. Additionally, a secondary vulnerability impacts the authorization model for PROFIBUS configuration management, allowing unauthorized administrative changes. Organizations using affected firmware versions (1.0.0 through 4.10.0) are at risk of complete device compromise.

Attack Chain

  1. Attacker gains authenticated access to the Web-Based Management (WBM) interface of the WAGO controller using compromised or default credentials.
  2. Attacker navigates to the routing configuration section of the WBM interface.
  3. Attacker crafts a malicious payload containing shell metacharacters injected into a routing parameter field.
  4. The WBM interface fails to sanitize the input and stores the malicious payload into a persistent configuration file on the system.
  5. A privileged root helper script periodically reads the configuration file for system updates or network synchronization.
  6. The root helper script interprets and executes the embedded malicious payload with root-level privileges.
  7. The attacker achieves arbitrary code execution as the root user, facilitating unauthorized system configuration or full control over the industrial controller.

Impact

The vulnerabilities represent a significant risk to industrial operations. Successful exploitation allows an authenticated attacker to execute arbitrary commands with root privileges on the device. Given the deployment of these controllers in critical infrastructure sectors - including energy, water, and transportation - this could lead to operational disruption, loss of control over industrial processes, or the manipulation of safety-critical parameters.

Recommendation

  1. Upgrade all affected WAGO controllers to firmware version 4.10.0 (FW32) or higher immediately to address CVE-2026-80466 and CVE-2026-88850.
  2. Restrict network access to the WBM interface to authorized management subnets only via firewall rules or physical network segmentation.
  3. Implement VPN access for remote management to ensure that WBM interfaces are not exposed directly to the internet.
  4. Audit access logs for the WBM interface to detect abnormal authentication patterns or attempts to modify routing and PROFIBUS configurations by non-administrative users.
  5. Review device manuals (specifically Sections 6 and 7 regarding security and VPN recommendations) for further hardening guidance provided by the vendor.
]]>highadvisoryicsscadavulnerabilitycommand-injection