PT-2020-18917 · Wago · Wago Pfc 200

Published 2020-06-11 · Updated 2023-02-07 · CVE-2020-6090

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions WAGO PFC 200 version 03.03.10(15)

Description A code execution issue exists in the Web-Based Management functionality, allowing remote code execution through specially crafted HTTP requests. An attacker can trigger this issue by making an authenticated HTTP request.

Recommendations For version 03.03.10(15), consider restricting access to the Web-Based Management functionality until a fix is available. As a temporary workaround, limit the ability to make authenticated HTTP requests to the vulnerable functionality.

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2020-6090

Affected Products

Wago Pfc 200

References · 3

• https://osv.dev/vulnerability/CVE-2020-6090 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-6090 · Security Note
• https://talosintelligence.com/vulnerability_reports/TALOS-2020-1010 · Note