CVE-2026-80466 & CVE-2026-88850: WAGO OS Linux WBM Privilege Escalation — ICS Detection and Remediation Guide

On the industrial side of the house, CISA has published ICSA-26-293-02 covering two privilege escalation vulnerabilities in WAGO OS Linux, the operating system underpinning WAGO's CC100, PFC100 G2, PFC200 G2, TP600, Edge Controller, and WP400 product lines. Both flaws — tracked as CVE-2026-80466 and CVE-2026-88850 — live in the Web-Based Management (WBM) interface and allow an authenticated low-privileged user to bypass intended privilege boundaries. One issue affects the routing configuration functionality; the other breaks the authorization model for PROFIBUS configuration management.

This is the kind of vulnerability class that keeps OT security engineers up at night. Field controllers running routing and PROFIBUS configuration sit at the intersection of IT and OT networks. A low-privileged account — the kind handed out for monitoring, read-only dashboards, or contractor access — becomes a stepping stone to full administrative control over devices that manage process networks and, in many architectures, route traffic between zones. While exploitation requires authentication and no public exploitation has been reported at the time of this writing, the barrier to entry is low: credential theft, password reuse, and default accounts are the rule, not the exception, in OT environments.

All firmware versions from 1.0.0 up to (but not including) 4.10.0 are affected. If you run WAGO controllers anywhere in your plant, water treatment facility, building automation system, or energy infrastructure, this advisory applies to you and firmware 4.10.0 is your remediation target.

Technical Analysis

Affected Products and Versions

Per the CISA advisory (ICSA-26-293-02), the vulnerabilities affect WAGO Firmware >= 1.0.0 and < 4.10.0 installed on the following hardware families:

• WAGO Hardware 0751-9x01 — all versions (both CVEs)
• WAGO Hardware 0750-811x-xxxx-xxxx — all versions (both CVEs)
• WAGO Hardware 0750-821x-xxx-xxx — all versions (both CVEs)

These part numbers map to WAGO's CC100 compact controllers, PFC100/PFC200 Generation 2 controllers, TP600 touch panels, Edge Controllers, and WP400 devices — hardware that is ubiquitous in discrete manufacturing, building automation, and energy distribution. Both CVE-2026-80466 and CVE-2026-88850 apply across the affected set.

How the Vulnerabilities Work

Both flaws are authorization bypass issues in the WBM web interface — the embedded management plane exposed over HTTP/HTTPS on the controller:

1. Routing configuration privilege bypass — A user authenticated with low privileges can invoke WBM functionality to modify the device's routing configuration that should be restricted to administrative roles. On a device that may be acting as a gateway between an OT cell/area zone and higher-level networks, unauthorized routing changes enable traffic redirection, man-in-the-middle positioning, or segmentation bypass — a direct violation of the zone-and-conduit model in IEC 62443.

2. PROFIBUS configuration authorization model flaw — The authorization model governing PROFIBUS configuration management fails to enforce role boundaries, allowing a low-privileged authenticated session to alter PROFIBUS fieldbus configuration. Modifying fieldbus parameters can disrupt or manipulate communication with process instrumentation and drives — availability and integrity impact at the physical process layer.

Exploitation requirements: network reachability to the WBM interface and valid low-privileged credentials. No user interaction beyond the attacker's own session is needed. This maps to MITRE ATT&CK for ICS technique T0855 (Unauthorized Command Message) and, in terms of initial access prerequisites, highlights the risk of weak credential hygiene described by T0812 (Default Credentials) where operators have never hardened WBM accounts.

Exploitation Status

At the time of publication, there are no confirmed reports of in-the-wild exploitation, and neither CVE has been added to the CISA Known Exploited Vulnerabilities catalog. The disclosure came through coordinated channels (CISA ICS advisory with CSAF machine-readable data). However, WBM interfaces are a well-understood attack surface, WAGO controllers are heavily fingerprinted in internet scanning datasets, and the exploitation path — authenticated HTTP requests against known endpoints — is straightforward to weaponize once the advisory details circulate. Treat the pre-exploitation window as short.

Detection & Response

Detection strategy for these flaws centers on three observable behaviors: (1) authentication events and configuration changes on the WBM interface, (2) configuration-modifying HTTP requests issued from accounts or source hosts that should be read-only, and (3) unexpected routing table or network configuration changes on the controllers themselves. Because WAGO controllers forward syslog, ingesting device logs into your SIEM is the single highest-value detection investment here.

---
title: WAGO WBM Configuration Change via Low-Privileged Session
id: 8c1f4e92-3b6a-4d58-9f2e-7a1c5d8b3e44
status: experimental
description: Detects HTTP POST/configuration-modifying requests against WAGO Web-Based Management endpoints associated with routing or PROFIBUS configuration, which may indicate exploitation of CVE-2026-80466 or CVE-2026-88850 authorization bypass.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-293-02
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.privilege_escalation
  - attack.t1078
  - ics.t0855
logsource:
  category: webserver
  product: linux
detection:
  selection_method:
    cs-method: 'POST'
  selection_paths:
    cs-uri-stem|contains:
      - '/wbm'
      - '/cgi-bin'
      - 'routing'
      - 'profibus'
      - 'network_config'
  condition: selection_method and selection_paths
falsepositives:
  - Legitimate engineering workstation configuration activity during maintenance windows
level: high
---
title: Authentication Anomaly on WAGO Controller WBM Interface
id: 2e7b9d41-6c3f-4a18-b5d9-9f4e2c7a6b11
status: experimental
description: Detects successful logins to WAGO WBM interfaces from source hosts outside expected engineering workstation or jump host ranges, a common precursor to authenticated exploitation of CVE-2026-80466 / CVE-2026-88850.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-293-02
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1078
logsource:
  category: authentication
  product: linux
detection:
  selection_success:
    EventType: 'login'
    Outcome: 'success'
  filter_approved_hosts:
    SourceHost|startswith:
      - '10.10.50.'   # Replace with your approved OT jump host / EWS subnet
      - '192.168.100.'
  condition: selection_success and not filter_approved_hosts
falsepositives:
  - New engineering workstations not yet added to the approved source list
level: medium

// Hunt for authentication and configuration activity against WAGO controllers
// Assumes WAGO syslog forwarded to Sentinel via Syslog/CEF collector
// Tune the WAGO host list to your environment's controller naming convention
let WagoHosts = dynamic(["cc100", "pfc100", "pfc200", "tp600", "edge-ctrl", "wp400", "751-9", "750-8"]);
union (Syslog | where Computer has_any (WagoHosts)),
      (CommonSecurityLog | where DeviceProduct has_any (WagoHosts) or DestinationHostName has_any (WagoHosts))
| where TimeGenerated > ago(14d)
| extend RawMsg = coalesce(Message, AdditionalExtensions)
| where RawMsg has_any ("login", "authentication", "wbm", "routing", "profibus", "config")
| summarize EventCount = count(),
            FirstSeen = min(TimeGenerated),
            LastSeen = max(TimeGenerated),
            SampleMessages = make_set(strcatsubstring(RawMsg, 0, 200), 5)
         by Computer, coalesce(SourceIP, SourceHostName)
| where EventCount > 0
| order by LastSeen desc

-- Hunt on OT jump hosts / engineering workstations for unexpected sessions
-- to WAGO WBM interfaces (TCP 80/443) targeting known controller subnets.
-- Deploy this artifact against your managed Windows/Linux jump hosts that
-- legitimately access WBM -- any source host NOT on the approved list is suspect.
SELECT Pid,
       Name,
       CommandLine,
       Username,
       netstat().Laddr.IP AS LocalIP,
       netstat().Raddr.IP AS RemoteIP,
       netstat().Raddr.Port AS RemotePort,
       netstat().Status AS ConnStatus
FROM pslist()
WHERE netstat().Raddr.Port in (80, 443)
  AND netstat().Status =~ 'ESTABLISHED'
  AND (netstat().Raddr.IP =~ '^10\\.20\\.' OR netstat().Raddr.IP =~ '^172\\.16\\.10\\.')  -- Replace with your WAGO controller subnets

#!/bin/bash
# WAGO CVE-2026-80466 / CVE-2026-88850 — fleet audit and verification script
# Run from an OT management host with SSH reachability to controllers.
# Requires a target list: one controller IP/hostname per line in wago_targets.txt

TARGETS="wago_targets.txt"
REPORT="wago_audit_$(date +%Y%m%d).csv"
SSH_USER="admin"   # Use a dedicated audit account, not shared credentials

echo "host,firmware_version,patched_status,reachability" > "$REPORT"

while read -r host; do
  [ -z "$host" ] && continue

  # Pull firmware version from the controller (adjust path per WAGO fw layout)
  fw=$(ssh -o ConnectTimeout=5 -o BatchMode=yes "${SSH_USER}@${host}" \
       'cat /etc/os-release 2>/dev/null | grep -i version; cat /etc/wago/fw_version 2>/dev/null' 2>/dev/null | tr '\n' ' ')

  if [ -z "$fw" ]; then
    echo "${host},UNKNOWN,UNREACHABLE_OR_AUTH_FAIL,no" >> "$REPORT"
    continue
  fi

  # Extract semver and compare against fixed version 4.10.0
  ver=$(echo "$fw" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1)
  major=$(echo "$ver" | cut -d. -f1)
  minor=$(echo "$ver" | cut -d. -f2)

  if [ "$major" -gt 4 ] || { [ "$major" -eq 4 ] && [ "$minor" -ge 10 ]; }; then
    status="PATCHED"
  else
    status="VULNERABLE - upgrade to >= 4.10.0"
  fi

  echo "${host},${ver},${status},yes" >> "$REPORT"
done < "$TARGETS"

echo "Audit complete: $REPORT"
echo "--- Vulnerable hosts: ---"
grep "VULNERABLE" "$REPORT" || echo "None found."

# Interim hardening: verify WBM is not exposed beyond the OT management zone.
# On your zone firewall/conduit, restrict TCP 80/443 to controllers to the
# approved engineering workstation subnet ONLY, e.g.:
#   iptables -A INPUT -p tcp -s 10.10.50.0/24 --dport 443 -d <wago_subnet> -j ACCEPT
#   iptables -A INPUT -p tcp --dport 443 -d <wago_subnet> -j DROP
# Additionally, audit WBM user accounts and remove any unused low-privileged
# accounts — the vulnerability requires authenticated access, so reducing the
# credential surface directly reduces exploitability.

Remediation

1. Upgrade to WAGO Firmware 4.10.0 or later. This is the fixed release for both CVE-2026-80466 and CVE-2026-88850 across all affected hardware families (0751-9x01, 0750-811x-xxxx-xxxx, 0750-821x-xxx-xxx). Obtain firmware through WAGO's official support channels and validate integrity before deployment. Schedule upgrades within your normal OT change windows, but treat internet-facing or cross-zone reachable WBM interfaces as urgent.

2. Inventory and prioritize. Use the audit script above (or passive asset data from your OT monitoring platform) to enumerate every CC100, PFC100 G2, PFC200 G2, TP600, Edge Controller, and WP400 on your network and record firmware versions. Controllers acting as routers between zones are your highest-risk assets — patch them first.

3. Reduce the credential surface. Both vulnerabilities require an authenticated low-privileged session. Audit WBM user accounts now: remove unused accounts, rotate all passwords, eliminate any default or shared credentials, and enforce unique per-operator accounts so privilege escalation events are attributable.

4. Enforce network segmentation. WBM should be reachable only from dedicated engineering workstations or OT jump hosts within the management zone. Verify firewall rules and conduit ACLs per IEC 62443 zone-and-conduit design. If any WBM interface is reachable from IT networks, guest networks, or the internet (check your external attack surface — WAGO devices are well-fingerprinted), close that exposure immediately as a compensating control until patching completes.

5. Enable and forward logging. Configure syslog forwarding from all WAGO controllers to your SIEM. Alert on successful WBM authentications from non-approved sources and on any routing or PROFIBUS configuration change outside approved maintenance windows.

6. Review the official advisories. Consult the full CISA advisory at https://www.cisa.gov/news-events/ics-advisories/icsa-26-293-02 and WAGO's security advisory (including the machine-readable CSAF document referenced in the disclosure) for vendor-specific guidance, updated CVSS scoring, and any additional mitigations.

7. Post-patch validation. After upgrading, verify the firmware version on each device, re-test that low-privileged accounts cannot access routing or PROFIBUS configuration functions, and confirm your detection rules fire on test configuration changes from authorized accounts.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub