CVE-2019-5161 An exploitable remote code execution vulnerability exists in the Cloud Connectivity functionality of WAGO PFC200 versions 03.02.02(14), 03.01.07(13), and 03.00.39(12). A specially crafted XML file wil...
CriticalCVSS 9.1
EPSS 2.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An exploitable remote code execution vulnerability exists in the Cloud Connectivity functionality of WAGO PFC200 versions 03.02.02(14), 03.01.07(13), and 03.00.39(12). A specially crafted XML file will direct the Cloud Connectivity service to download and execute a shell script with root privileges.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| WAGO pfc200 firmware | = 03.00.39(12) | No fix listed |
| WAGO pfc200 firmware | = 03.01.07(13) | No fix listed |
| WAGO pfc200 firmware | = 03.02.02(14) | No fix listed |
| WAGO PFC200 Firmware | = version 03.02.02(14) | No fix listed |
| WAGO PFC200 Firmware | = version 03.01.07(13) | No fix listed |
| WAGO PFC200 Firmware | = version 03.00.39(12) | No fix listed |
References
- talosintelligence.com exploit mitigation third-party-advisory