WAGO: Unauthenticated command execution via Web-based-management UPDATE A

An attacker on the network can execute arbitrary commands on WAGO controllers and HMIs, potentially altering process parameters, stopping operations, or modifying system configurations without warning. Physical processes controlled by these devices could be disrupted or damaged.

Water utilities, municipalities, and industrial facilities using WAGO controllers should assess their exposure. This affects WAGO Compact Controller 100, Edge Controller, PFC100, PFC200 controllers, and Touch Panel 600 HMI devices. Equipment typically used for process control, automation, and monitoring in water distribution, wastewater treatment, power distribution, and other critical infrastructure.

An attacker sends a specially crafted HTTP request to the web-based-management interface targeting the 'legal information' plugin. The vulnerable plugin processes the request and executes arbitrary commands with www user privileges on the device. No authentication is required; the attack can be launched from any network path that reaches the device's HTTP port.