PT-2019-17457 · Wago · Wago Pfc 200+1

Published 2019-12-18 · Updated 2020-08-24 · CVE-2019-5075

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WAGO PFC200 Firmware versions 03.01.07(13) and 03.00.39(12) WAGO PFC100 Firmware version 03.00.39(12)

Description A stack buffer overflow issue exists in the command line utility getcouplerdetails. This can be triggered by sending a specially crafted set of packets to the "I/O-Check" iocheckd service, causing a stack buffer overflow in the sub-process getcouplerdetails and potentially allowing code execution. An attacker can send unauthenticated packets to exploit this issue.

Recommendations For WAGO PFC200 Firmware versions 03.01.07(13) and 03.00.39(12), consider disabling the getcouplerdetails utility until a patch is available. For WAGO PFC100 Firmware version 03.00.39(12), consider disabling the getcouplerdetails utility until a patch is available. Restrict access to the iocheckd service "I/O-Check" to minimize the risk of exploitation.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2019-5075

Affected Products

Wago Pfc100

Wago Pfc 200

References · 3

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2019-0864 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-5075 · Security Note
• https://osv.dev/vulnerability/CVE-2019-5075 · Vendor Advisory