PT-2019-17455 · Wago · Wago Pfc 200+1
Kelly Leuschner
·
Published
2019-12-18
·
Updated
2019-12-27
·
CVE-2019-5073
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
WAGO PFC200 Firmware versions 03.01.07(13) and 03.00.39(12)
WAGO PFC100 Firmware version 03.00.39(12)
Description
An exploitable information exposure issue exists in the iocheckd service "I/O-Check" functionality. This issue can be triggered by a specially crafted set of packets, causing an external tool to fail and resulting in uninitialized stack data being copied to the response packet buffer. An attacker can send unauthenticated packets to exploit this issue.
Recommendations
For WAGO PFC200 Firmware versions 03.01.07(13) and 03.00.39(12), update to a fixed version to resolve the issue.
For WAGO PFC100 Firmware version 03.00.39(12), update to a fixed version to resolve the issue.
As a temporary workaround, consider restricting access to the iocheckd service to minimize the risk of exploitation.
Exploit
Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Wago Pfc100
Wago Pfc 200