CRITICAL🇵🇱 Wersja polska

CVE-2019-5161

CVSS 9.1v3.1pub. 2020-03-11upd. 2024-11-21

An exploitable remote code execution vulnerability exists in the Cloud Connectivity functionality of WAGO PFC200 versions 03.02.02(14), 03.01.07(13), and 03.00.39(12). A specially crafted XML file will direct the Cloud Connectivity service to download and execute a shell script with root privileges.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

  • Wago Pfc200

    HW
    Wago
    all versions

  • Wago Pfc200 Firmware

    OS
    Wago
    03.00.39\(12\)03.01.07\(13\)03.02.02\(14\)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2023-1698CRITICAL9.8PL ✓same product

WAGO: Zdalne przejęcie kontroli przez nieuprawnionego atakującego (command injection)

CVE-2022-45140CRITICAL9.8PL ✓same product

WAGO 751/752: Nieuwierzytelniony zapis danych z uprawnieniami root – RCE

CVE-2022-45138CRITICAL9.8PL ✓same product

WAGO 751-9301/752-8303: Pominięcie uwierzytelnienia w API zarządzania

CVE-2019-5160CRITICAL9.1PL ✓same product

WAGO PFC200 — nieprawidłowa walidacja hosta w module Cloud Connectivity

CVE-2020-8597CRITICAL9.8PL ✓same product

Buffer overflow w pppd (ppp 2.4.2–2.4.8) — podatność w obsłudze EAP