PT-2019-17462 · Wago · Wago Pfc 200+1

Kelly Leuschner · Publicado 2019-12-18 · Atualizado 2019-12-27 · CVE-2019-5080

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions WAGO PFC 200 Firmware versions 03.01.07(13) and 03.00.39(12) WAGO PFC100 Firmware version 03.00.39(12)

Description A denial-of-service issue exists in the iocheckd service, specifically in the "I/O-Check" functionality. This can be triggered by a single packet, causing a denial of service and weakening credentials, which results in the device applying default documented credentials. An attacker can exploit this by sending an unauthenticated packet.

Recommendations For WAGO PFC 200 Firmware versions 03.01.07(13) and 03.00.39(12), consider disabling the iocheckd service until a patch is available. For WAGO PFC100 Firmware version 03.00.39(12), consider disabling the iocheckd service until a patch is available. As a temporary workaround, restrict access to the device to minimize the risk of exploitation.

Correção

Missing Authentication

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

CVE-2019-5080

Produtos afetados

Wago Pfc 200

Wago Pfc100

Referências · 3

• https://talosintelligence.com/vulnerability_reports/TALOS-2019-0872 · Nota
• https://osv.dev/vulnerability/CVE-2019-5080 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-5080 · Nota de Segurança