CVE-2019-5174: Command Injection
An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 version 03.02.02(14). A specially crafted XML cache file written to a specific location on the device can be used to inject OS commands. An attacker can send a specially crafted packet to trigger the parsing of this cache file.At 0x1e9fc the extracted subnetmask value from the xml file is used as an argument to /etc/config-tools/configinterfaces interface=X1 state=enabled subnet-mask=<contents of subnetmask node> using sprintf(). This command is later executed via a call to system().
Affected Software
Event History
Frequently Asked Questions
What is the CVE ID of this vulnerability?
The CVE ID of this vulnerability is CVE-2019-5174.
What is the severity rating of CVE-2019-5174?
The severity rating of CVE-2019-5174 is 7.8 (High).
Which software versions are affected by CVE-2019-5174?
The WAGO PFC 200 firmware version 03.02.02(14) is affected by CVE-2019-5174.
How can an attacker exploit this vulnerability?
An attacker can exploit this vulnerability by sending a specially crafted XML cache file to the iocheckd service of the WAGO PFC 200 device.
Is the WAGO PFC200 hardware affected by CVE-2019-5174?
No, the WAGO PFC200 hardware is not affected by CVE-2019-5174.