PT-2019-17457 · Wago · Wago Pfc 200+1

Publicado 2019-12-18 · Atualizado 2020-08-24 · CVE-2019-5075

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WAGO PFC200 Firmware versions 03.01.07(13) and 03.00.39(12) WAGO PFC100 Firmware version 03.00.39(12)

Description A stack buffer overflow issue exists in the command line utility getcouplerdetails. This can be triggered by sending a specially crafted set of packets to the "I/O-Check" iocheckd service, causing a stack buffer overflow in the sub-process getcouplerdetails and potentially allowing code execution. An attacker can send unauthenticated packets to exploit this issue.

Recommendations For WAGO PFC200 Firmware versions 03.01.07(13) and 03.00.39(12), consider disabling the getcouplerdetails utility until a patch is available. For WAGO PFC100 Firmware version 03.00.39(12), consider disabling the getcouplerdetails utility until a patch is available. Restrict access to the iocheckd service "I/O-Check" to minimize the risk of exploitation.

Exploit

Correção

Memory Corruption

Enumeração de Fraquezas

CWE-787

Identificadores relacionados

CVE-2019-5075

Produtos afetados

Wago Pfc100

Wago Pfc 200

Referências · 3

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2019-0864 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-5075 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-5075 · Aviso do Fabricante