CVE-2019-5134: vulnerability in WAGO PFC100 Firmware
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 2.3%
In short
A flaw in the login system of WAGO industrial controllers allows attackers to bypass security checks using specially crafted requests, potentially accessing sensitive information without proper authentication.
Technical detail
The WBM authentication mechanism employs an unanchored regular expression for input validation, permitting attackers to craft requests that evade the regex filter and gain unauthorized access to protected resources. This affects WAGO PFC200 (v03.00.39(12) and v03.01.07(13)) and PFC100 (v03.00.39(12)).
Summary generated and translated by AI from the official description.
An exploitable regular expression without anchors vulnerability exists in the Web-Based Management (WBM) authentication functionality of WAGO PFC200 versions 03.00.39(12) and 03.01.07(13), and WAGO PFC100 version 03.00.39(12). A specially crafted authentication request can bypass regular expression filters, resulting in sensitive information disclosure.
Related CVEs — WAGO PFC100 Firmware
In the same product, most dangerous first.