CVE-2019-5078: Critical severity wago pfc200 vulnerability

Published Dec 18, 2019

Updated

An exploitable denial of service vulnerability exists in the iocheckd service "I/O-Check" functionality of WAGO PFC200 Firmware versions 03.01.07(13) and 03.00.39(12), and WAGO PFC100 Firmware version 03.00.39(12). A specially crafted set of packets can cause a denial of service, resulting in the device entering an error state where it ceases all network communications. An attacker can send unauthenticated packets to trigger this vulnerability.

Affected Software

5 affected components

WAGO PFC 200 Firmware=03.00.39\(12\)

WAGO PFC 200 Firmware=03.01.07\(13\)

WAGO PFC 200

WAGO PFC 100 Firmware=03.00.39\(12\)

WAGO PFC 100

Event History

Dec 18, 2019

CVE Published

via MITRE·08:51 PM

Data Sourced

via MITRE·08:51 PM

DescriptionWeakness

Frequently Asked Questions

What is the vulnerability ID of this issue?

The vulnerability ID is CVE-2019-5078.

What is the severity of CVE-2019-5078?

The severity of CVE-2019-5078 is critical with a CVSS score of 9.1.

Which software versions are affected by CVE-2019-5078?

WAGO PFC200 Firmware versions 03.01.07(13) and 03.00.39(12), and WAGO PFC100 Firmware version 03.00.39(12) are affected.

How can CVE-2019-5078 be exploited?

CVE-2019-5078 can be exploited by sending a specially crafted set of packets to the iocheckd service.

Is the WAGO PFC200 device itself vulnerable to CVE-2019-5078?

No, the WAGO PFC200 device itself is not vulnerable to CVE-2019-5078.