WAGO OS Linux

Two high-severity vulnerabilities have been identified in the Web-Based Management (WBM) interface of several WAGO industrial controller and edge device lines. These flaws allow an authenticated user with low privileges to bypass security boundaries, specifically affecting the authorization models for PROFIBUS configuration and routing settings. The technical nature of the bugs includes missing authorization and the potential for OS command injection, leading to a high risk of unauthorized system control.
The impact spans a wide range of WAGO hardware deployed globally across critical infrastructure sectors, such as energy, transportation, and water systems. To resolve these issues, WAGO recommends an immediate update to firmware version 4.10.0 (FW32) or later. In addition to patching, the manufacturer suggests implementing broader security measures, including restricting physical access to hardware and utilizing VPNs for remote management.

* WAGO OS Linux is affected by two vulnerabilities in the Web-Based Management (WBM) interface.
* Affected devices include WAGO CC100, PFC100 G2, PFC200 G2, TP600, Edge Controller, and WP400.
* The vulnerabilities impact routing configuration functionality and PROFIBUS configuration management authorization.
* Authenticated low-privileged users can bypass intended privilege boundaries.
* WAGO Firmware versions from 1.0.0 up to, but not including, 4.10.0 are affected.
* Impacted hardware includes various models in the 0751, 0750, 0762, and 0752 series.
* CVE-2026-80466 and CVE-2026-88850 are the associated identifiers.
* The CVSS v3.1 score is 8.8 (High) and CVSS v4.0 is 8.7 (High).
* The vulnerabilities involve Missing Authorization and OS Command Injection (CWE-78).
* WAGO recommends updating to firmware Version 4.10.0 (FW32) or higher.
* WAGO provides security manuals for PFC100 / PFC200 products with recommendations on physical access and VPNs.
* WAGO is headquartered in Germany and its products are deployed worldwide in sectors including Energy, Water, and Chemical.

The strongest version of this narrative is a transparent, vendor-led security disclosure designed to protect critical infrastructure by providing specific version numbers, CVEs, and clear remediation paths. It is a textbook example of responsible disclosure in the Industrial Control Systems (ICS) space, where the goal is to minimize the window of opportunity for attackers.
The pattern here is purely technical and administrative. Because this is a security advisory—essentially a technical erratum—it lacks the persuasive architecture of a media piece. There is no attempt to manufacture fear or drive a sale; the "call to action" is a free firmware update to a product the user already owns.
Patterns detected: none
The root cause is the inherent tension between the convenience of web-based management (WBM) and the rigid security requirements of industrial hardware. As OT (Operational Technology) converges with IT, legacy authorization models often fail to account for the granular privilege boundaries required in modern networking.
The implications highlight a persistent vulnerability in global critical infrastructure: the reliance on "low-privileged" accounts that can be escalated to achieve full system compromise. While the vendor provides the fix, the cost of downtime for patching in a 24/7 chemical or energy plant often outweighs the perceived risk, leaving a "patch gap" that attackers exploit.
Bridge Questions:
1. How does the "patch gap" in critical infrastructure affect the actual risk profile compared to the theoretical CVSS score?
2. What systemic changes are required to move beyond the cycle of "find-patch-repeat" in industrial firmware?
Counterstrike Scan: If this were an influence campaign, a bad actor would leak this information to a third party first to create panic and undermine trust in WAGO's reliability before the patch was ready. This content does not match that pattern; it is a controlled, professional disclosure.