PT-2019-17461 · Wago · Wago Pfc 200+1

Published 2019-12-18 · Updated 2019-12-27 · CVE-2019-5079

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WAGO PFC200 Firmware versions 03.01.07(13) and 03.00.39(12) WAGO PFC100 Firmware version 03.00.39(12)

Description A heap buffer overflow issue exists in the iocheckd service "I/O-Check" functionality. This can be triggered by a specially crafted set of packets, potentially resulting in code execution. An attacker can send unauthenticated packets to exploit this issue.

Recommendations For WAGO PFC200 Firmware versions 03.01.07(13) and 03.00.39(12), update to a version that fixes the iocheckd service "I/O-Check" functionality issue. For WAGO PFC100 Firmware version 03.00.39(12), update to a version that fixes the iocheckd service "I/O-Check" functionality issue. As a temporary workaround, consider restricting access to the iocheckd service to minimize the risk of exploitation.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2019-5079

Affected Products

Wago Pfc100

Wago Pfc 200

References · 3

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2019-0871 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-5079 · Security Note
• https://osv.dev/vulnerability/CVE-2019-5079 · Vendor Advisory