CISA has issued an Industrial Control Systems advisory (ICSA-26-293-02) disclosing two vulnerabilities in the Web-Based Management (WBM) interface of various WAGO controllers. The flaws, tracked as CVE-2026-80466 and CVE-2026-88850, affect WAGO OS Linux firmware versions prior to 4.10.0 across numerous hardware platforms. CVE-2026-80466 involves OS command injection through routing configuration, while CVE-2026-88850 involves missing authorization for PROFIBUS configuration management. Both vulnerabilities allow an authenticated low-privileged user to bypass intended privilege boundaries. WAGO recommends updating to firmware version 4.10.0 or higher.

Which products are affected?

WAGO Firmware >=1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, <4.10.0 installed on WAGO Hardware 0762-340x

What should defenders do?

Update WAGO OS Linux firmware to version 4.10.0 or higher. Contact WAGO support for custom firmware. Refer to product manuals for security recommendations specific to Controller PFC100/PFC200 products.

highCVE

WAGO OS Linux Vulnerabilities Allow Privilege Escalation via Web Management Interface

Q: What should defenders do?

Update WAGO OS Linux firmware to version 4.10.0 or higher. Contact WAGO support for custom firmware. Refer to product manuals for security recommendations specific to Controller PFC100/PFC200 products.

Two CVEs affect WAGO controllers used in critical infrastructure; authenticated low-privileged users can bypass privilege boundaries

Cyber.TechVoidPublished about 1 hour agoUpdated less than a minute ago2 min read

Key Takeaways

Two vulnerabilities (CVE-2026-80466, CVE-2026-88850) affect WAGO OS Linux firmware < 4.10.0 via the Web-Based Management interface.
CVE-2026-80466 allows OS command injection via routing configuration, potentially leading to root-level command execution.
CVE-2026-88850 allows bypass of authorization for PROFIBUS configuration management.
Affected hardware spans multiple WAGO controller families deployed worldwide in critical infrastructure sectors.
WAGO recommends updating to firmware version 4.10.0 or later as the primary mitigation.

Related Security News

highCVE

Multiple Vulnerabilities Discovered in Hitachi Energy RTU500 Series CMU Firmware

Hitachi Energy has disclosed seven vulnerabilities affecting the RTU500 series CMU Firmware across multiple version ranges. The flaws range from NULL pointer dereference and type confusion to authentication bypass vulnerabilities that could impact the confidentiality, integrity, and availability of energy sector industrial control systems. CISA has issued advisory ICSA-26-293-05 with remediation guidance.

CISA Advisoriesabout 1 hour ago2 min read

WAGO OS Linux Vulnerabilities Allow Privilege Escalation via Web Management Interface

Key Takeaways

Related Security News

Multiple Vulnerabilities Discovered in Hitachi Energy RTU500 Series CMU Firmware

Quick answers

Security Details

Sources

Moxa AIG-302 ThingsPro Edge Firmware Vulnerabilities Disclosed

Multiple Vulnerabilities Discovered in Hitachi Energy MicroSCADA X SYS600 Including CSV Injection and Privilege Escalation

CISA Adds Six New Vulnerabilities to Known Exploited Vulnerabilities Catalog

Active Exploitation of OS Command Injection in SiteGuard Server Edition WAF

Drupal patches critical RCE flaws, warns of imminent exploitation