CVE-2019-5176: Buffer Overflow

Published Mar 11, 2020

Updated

An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service ‘I/O-Check’ functionality of WAGO PFC 200 Firmware version 03.02.02(14). An attacker can send a specially crafted packet to trigger the parsing of this cache file.The destination buffer sp+0x40 is overflowed with the call to sprintf() for any gateway values that are greater than 512-len(‘/etc/config-tools/configdefaultgateway number=0 state=enabled value=‘) in length. A gateway value of length 0x7e2 will cause the service to crash.

Affected Software

2 affected components

WAGO PFC200 Firmware=03.02.02\(14\)

WAGO PFC200

Event History

Mar 11, 2020

CVE Published

via MITRE·11:24 PM

Data Sourced

via MITRE·11:24 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2019-5176?

The severity of CVE-2019-5176 is medium.

What is the affected software for CVE-2019-5176?

The affected software for CVE-2019-5176 is WAGO PFC 200 Firmware version 03.02.02(14).

How can an attacker exploit CVE-2019-5176?

An attacker can exploit CVE-2019-5176 by sending a specially crafted packet to trigger the parsing of the cache file in the iocheckd service 'I/O-Check' functionality of WAGO PFC 200 Firmware.

Is WAGO PFC200 vulnerable to CVE-2019-5176?

No, WAGO PFC200 is not vulnerable to CVE-2019-5176.

Are there any references for CVE-2019-5176?

Yes, you can refer to the following link for more information: [CVE-2019-5176](https://talosintelligence.com/vulnerability_reports/TALOS-2019-0963).