CVE-2019-5149
First published: Tue Mar 10 2020(Updated: )
The WBM web application on firmwares prior to 03.02.02 and 03.01.07 on the WAGO PFC100 and PFC2000, respectively, runs on a lighttpd web server and makes use of the FastCGI module, which is intended to provide high performance for all Internet applications without the penalties of Web server APIs. However, the default configuration of this module appears to limit the number of concurrent php-cgi processes to two, which can be abused to cause a denial of service of the entire web server. This affects WAGO PFC200 Firmware version 03.00.39(12) and version 03.01.07(13), and WAGO PFC100 Firmware version 03.00.39(12) and version 03.02.02(14).
Credit: talos-cna@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| WAGO PFC200 Firmware | =03.00.39\(12\) | |
| WAGO PFC200 Firmware | =03.01.07\(13\) | |
| WAGO PFC200 | ||
| WAGO PFC100 Firmware | =03.00.39\(12\) | |
| WAGO PFC100 Firmware | =03.01.07\(13\) | |
| WAGO PFC100 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2019-5149.
What is the severity of CVE-2019-5149?
The severity of CVE-2019-5149 is high with a score of 7.5.
Which WAGO devices are affected by this vulnerability?
The WAGO PFC100 and PFC2000 devices with firmwares prior to 03.02.02 and 03.01.07, respectively, are affected by this vulnerability.
What is the WBM web application used in this vulnerability?
The WBM web application is a web server running on lighttpd and makes use of the FastCGI module.
How can I fix CVE-2019-5149?
To fix CVE-2019-5149, update the firmware of the WAGO PFC100 and PFC2000 devices to version 03.02.02 and 03.01.07, respectively.
- collector/nvd-index
- agent/references
- agent/weakness
- agent/severity
- agent/tags
- agent/type
- agent/event
- agent/author
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- vendor/wago
- canonical/wago pfc200 firmware
- version/wago pfc200 firmware/03.00.39\(12\)
- version/wago pfc200 firmware/03.01.07\(13\)
- canonical/wago pfc200
- canonical/wago pfc100 firmware
- version/wago pfc100 firmware/03.00.39\(12\)
- version/wago pfc100 firmware/03.01.07\(13\)
- canonical/wago pfc100