WAGO: Multiple vulnerabilities in docker configuration

An authenticated attacker could escalate privileges and gain control of the CODESYS runtime environment, potentially allowing them to modify process logic, alter safety parameters, or disrupt plant operations on affected WAGO controllers.

WAGO industrial controllers and human-machine interfaces used in manufacturing, water, utilities, and energy sectors. Affected models include: CC100, PFC100 G2, PFC200 G2, TP600 touchscreen panels, Edge Controller, and legacy PFC100/PFC200 G1 devices. Organizations using these as programmable logic controllers (PLCs) or process monitors should prioritize assessment.

An attacker with valid user account credentials logs into the affected controller. Because the linux user "user" is misconfigured as a member of the 'wbmuser' group, the attacker gains group membership that bypasses intended access controls. The attacker then exploits missing CODESYS Runtime access controls (CWE-306) to interact with and modify the runtime environment, potentially altering process execution or safety interlocks.