PT-2019-17460 · Wago · Wago Pfc 200+1

Published 2019-12-18 · Updated 2019-12-27 · CVE-2019-5078

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Critical

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions WAGO PFC200 Firmware versions 03.01.07(13) and 03.00.39(12) WAGO PFC100 Firmware version 03.00.39(12)

Description A denial of service issue exists in the iocheckd service "I/O-Check" functionality. It can be triggered by a specially crafted set of packets, causing the device to enter an error state and cease all network communications. This can be done by sending unauthenticated packets.

Recommendations For WAGO PFC200 Firmware versions 03.01.07(13) and 03.00.39(12), consider restricting access to the iocheckd service until a patch is available. For WAGO PFC100 Firmware version 03.00.39(12), consider restricting access to the iocheckd service until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2019-5078

Affected Products

Wago Pfc100

Wago Pfc 200

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2019-5078 · Security Note
• https://osv.dev/vulnerability/CVE-2019-5078 · Vendor Advisory
• https://talosintelligence.com/vulnerability_reports/TALOS-2019-0870 · Note