As reported by CISA in advisory ICSA-26-293-02, two vulnerabilities in WAGO OS Linux's Web-Based Management (WBM) interface enable authenticated low-privileged users to bypass intended authorization boundaries. CVE-2026-80466 and CVE-2026-88850 affect a wide swath of WAGO industrial hardware — from the compact CC100 controller to PFC200 G2 PLCs, TP600 touch panels, Edge Controllers, and WP400 devices — spanning more than a dozen hardware SKUs across the 075x, 0762, and 0752 series.
Why This Matters
WAGO controllers are deeply embedded in manufacturing floors, building automation systems, and energy infrastructure across the globe. These devices often sit at the boundary between IT and OT networks, making them attractive pivot points for attackers seeking to move from corporate networks into process control environments. The fact that both flaws require only low-privileged authentication — not admin-level access — significantly lowers the barrier for exploitation. Any compromised operator account, service credential, or default-user foothold becomes a potential launchpad for privilege escalation.
CVE-2026-80466 targets the routing configuration functionality, allowing a low-privilege user to manipulate network routing — a capability that could redirect traffic, enable man-in-the-middle positioning, or sever communication paths to supervisory systems. CVE-2026-88850 breaks the authorization model for PROFIBUS configuration management, potentially allowing tampering with fieldbus communication parameters that govern sensor and actuator traffic on the factory floor.
Vulnerability Details
| CVE | Affected Component | Impact |
|---|---|---|
| CVE-2026-80466 | WBM Routing Configuration | Privilege escalation — routing manipulation |
| CVE-2026-88850 | WBM PROFIBUS Configuration Authorization | Privilege escalation — fieldbus config tampering |
- Vendor: WAGO
- Affected Firmware: WAGO OS Linux versions >= 1.0.0 and < 4.10.0
- Affected Hardware: 0751-9x01, 0750-811x, 0750-821x, 0762-340x, 0762-420x, 0762-430x, 0762-520x, 0762-530x, 0762-620x, 0762-630x, 0752-8303-8000-0002 (CC100, PFC100 G2, PFC200 G2, TP600, Edge Controller, WP400)
- Authentication Required: Yes — low-privileged account
- Network Exposure: WBM interface (typically HTTP/HTTPS)
- Patch Available: Upgrade to firmware version 4.10.0 or later
- Active Exploitation: Not indicated in the advisory, but exploit feasibility is high given low-privilege prerequisite
Broader Implications for OT Security
These vulnerabilities underscore a persistent problem in ICS device management: the gap between authentication and authorization in embedded web interfaces. Many industrial controllers ship with management interfaces that were designed for convenience on isolated engineering networks but now face exposure through remote access solutions, VPNs, and cloud-connected architectures. The combination of low-privilege escalation and network routing manipulation is particularly dangerous — an attacker who gains even read-only access through a shared service account could reconfigure routing to isolate a PLC from its SCADA system, potentially causing process disruption or safety incidents.
The threat model for OT devices can no longer assume that any authenticated user is a trusted user. Low-privilege escalation flaws effectively collapse the authentication boundary into a single point of failure.
Shield53 Recommendations
Immediate Actions:
- Patch urgently: Inventory all WAGO devices in your environment and upgrade firmware to version 4.10.0 or later. Prioritize devices with WBM interfaces reachable from non-engineering networks.
- Restrict WBM access: Ensure the Web-Based Management interface is only accessible from dedicated engineering VLANs or jump hosts. Apply firewall rules and ACLs to block port 80/443 access to these devices from general user networks.
- Audit user accounts: Review all existing WBM user accounts on WAGO devices. Remove unused accounts, disable default credentials, and enforce unique passwords per device. Rotate any shared service credentials immediately.
- Network segmentation: Confirm that WAGO controllers are segmented from corporate IT networks using VLANs, firewalls, or industrial DMZs. Validate that no device WBM interfaces are exposed to the public internet — use CISA's CSET or free Shodan searches to verify exposure.
- Monitor for exploitation: Enable logging on WBM where available and monitor for unauthorized routing configuration changes or PROFIBUS parameter modifications. Deploy network intrusion detection signatures for anomalous HTTP traffic targeting WAGO device management endpoints.
- Vendor hardening: Request that WAGO disable low-privilege access to routing and PROFIBUS configuration by default in future firmware releases, and implement proper RBAC enforcement at the API layer rather than relying on UI-level controls.
For organizations running large WAGO deployments, this is also an opportunity to reassess the broader ICS access management strategy. Centralized credential vaulting, session recording, and just-in-time access provisioning should replace standing credentials on industrial devices wherever possible. The cost of implementing these controls is far lower than the cost of a process-safety incident traced back to a low-privilege account that should never have been able to change a routing table.
