Machine-generated analysis · WAYSCloud LLM
Authenticated low-privileged users can bypass privilege boundaries in the WBM interface of WAGO OS Linux. The issue affects firmware versions 1.0.0 up to but not including 4.10.0 on multiple WAGO controller models.
Context
The advisory concerns the Web-Based Management (WBM) interface of WAGO OS Linux on WAGO CC100, PFC100 G2, PFC200 G2, TP600, Edge Controller and WP400 devices. It reports two vulnerabilities that allow an authenticated low-privileged user to bypass intended privilege boundaries, impacting routing configuration functionality and the PROFIBUS configuration management authorization model. The vulnerabilities affect firmware versions ≥1.0.0 and <4.10.0 across the listed hardware part numbers. The advisory does not reference a released patch.
Operator considerations
Check: Verify firmware version on affected WAGO devices is not within the vulnerable range (≥1.0.0 <4.10.0).
Two vulnerabilities in the Web-Based Management (WBM) interface of WAGO CC100, PFC100 G2, PFC200 G2, TP600, Edge Controller and WP400 devices allow an authenticated low-privileged user to bypass intended privilege boundaries. The issues affect both the routing configuration functionality and the authorization model for PROFIBUS configuration management.
Read the full advisory on CISA →