CRITICAL🇵🇱 Wersja polska

CVE-2019-5160

CVSS 9.1v3.1pub. 2020-03-11upd. 2024-11-21

An exploitable improper host validation vulnerability exists in the Cloud Connectivity functionality of WAGO PFC200 Firmware versions 03.02.02(14), 03.01.07(13), and 03.00.39(12). A specially crafted HTTPS POST request can cause the software to connect to an unauthorized host, resulting in unauthorized access to firmware update functionality. An attacker can send an authenticated HTTPS POST request to direct the Cloud Connectivity software to connect to an attacker controlled Azure IoT Hub node.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

  • Wago Pfc200

    HW
    Wago
    all versions

  • Wago Pfc200 Firmware

    OS
    Wago
    03.00.39\(12\)03.01.07\(13\)03.02.02\(14\)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2023-1698CRITICAL9.8PL ✓same product

WAGO: Zdalne przejęcie kontroli przez nieuprawnionego atakującego (command injection)

CVE-2022-45140CRITICAL9.8PL ✓same product

WAGO 751/752: Nieuwierzytelniony zapis danych z uprawnieniami root – RCE

CVE-2022-45138CRITICAL9.8PL ✓same product

WAGO 751-9301/752-8303: Pominięcie uwierzytelnienia w API zarządzania

CVE-2019-5161CRITICAL9.1PL ✓same product

RCE w WAGO PFC200 — złośliwy plik XML prowadzi do wykonania kodu z uprawnieniami root

CVE-2020-8597CRITICAL9.8PL ✓same product

Buffer overflow w pppd (ppp 2.4.2–2.4.8) — podatność w obsłudze EAP