CVE-2019-5173

CVE-2019-5173: vulnerability in WAGO PFC200

Published · Updated

Follow this CVE+ Monitor WAGO PFC200

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 1.4%
In short

A WAGO PFC 200 device allows attackers to run unauthorized commands by crafting a malicious XML file that gets executed by the iocheckd service. This is dangerous because an attacker can gain full control of the device.

Technical detail

Command injection vulnerability in WAGO PFC 200 iocheckd service (I/O-Check function) where unsanitized state values from XML cache files are passed to sprintf() and executed via system() calls. Attack vector requires crafting a malicious XML cache file at a specific location and sending a packet to trigger parsing; impact is arbitrary OS command execution with service privileges.

Summary generated and translated by AI from the official description.
An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 Firmware version 03.02.02(14). A specially crafted XML cache file written to a specific location on the device can be used to inject OS commands. An attacker can send a specially crafted packet to trigger the parsing of this cache file. At 0x1e9fc the extracted state value from the xml file is used as an argument to /etc/config-tools/config_interfaces interface=X1 state=<contents of state node> using sprintf(). This command is later executed via a call to system().
Affected products
Wago · WAGO PFC200
Related CVEs — WAGO PFC200

In the same product, most dangerous first.

CVE-2019-5171—CVE-2019-5171EPSS 1.4%CVE-2019-5170—CVE-2019-5170EPSS 1.4%CVE-2019-5169—CVE-2019-5169EPSS 1.4%CVE-2019-5175—CVE-2019-5175EPSS 1.4%CVE-2019-5172—CVE-2019-5172EPSS 1.3%CVE-2019-5181—CVE-2019-5181EPSS 0.8%