PT-2019-17455 · Wago · Wago Pfc 200+1

Kelly Leuschner · Publicado 2019-12-18 · Atualizado 2019-12-27 · CVE-2019-5073

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions WAGO PFC200 Firmware versions 03.01.07(13) and 03.00.39(12) WAGO PFC100 Firmware version 03.00.39(12)

Description An exploitable information exposure issue exists in the iocheckd service "I/O-Check" functionality. This issue can be triggered by a specially crafted set of packets, causing an external tool to fail and resulting in uninitialized stack data being copied to the response packet buffer. An attacker can send unauthenticated packets to exploit this issue.

Recommendations For WAGO PFC200 Firmware versions 03.01.07(13) and 03.00.39(12), update to a fixed version to resolve the issue. For WAGO PFC100 Firmware version 03.00.39(12), update to a fixed version to resolve the issue. As a temporary workaround, consider restricting access to the iocheckd service to minimize the risk of exploitation.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2019-5073

Produtos afetados

Wago Pfc100

Wago Pfc 200

Referências · 3

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2019-0862 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-5073 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-5073 · Aviso do Fabricante