CVE-2019-5177: Buffer Overflow

Published Mar 11, 2020

Updated

An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service ‘I/O-Check’ functionality of WAGO PFC 200 Firmware version 03.02.02(14). The destination buffer sp+0x440 is overflowed with the call to sprintf() for any domainname values that are greater than 1024-len(‘/etc/config-tools/editdnsserver domain-name=‘) in length. A domainname value of length 0x3fa will cause the service to crash.

Affected Software

2 affected components

WAGO PFC200 Firmware=03.02.02\(14\)

WAGO PFC200

Event History

Mar 11, 2020

CVE Published

via MITRE·11:25 PM

Data Sourced

via MITRE·11:25 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2019-5177?

The severity of CVE-2019-5177 is medium with a CVSS score of 5.5.

What is the affected software for CVE-2019-5177?

The affected software for CVE-2019-5177 is WAGO PFC 200 Firmware version 03.02.02(14).

How does CVE-2019-5177 affect WAGO PFC 200 Firmware?

CVE-2019-5177 affects WAGO PFC 200 Firmware version 03.02.02(14) by causing a stack buffer overflow vulnerability in the iocheckd service 'I/O-Check' functionality.

Is WAGO PFC200 vulnerable to CVE-2019-5177?

No, WAGO PFC200 is not vulnerable to CVE-2019-5177.

How can I fix CVE-2019-5177?

To fix CVE-2019-5177, it is recommended to update to a version of WAGO PFC 200 Firmware that is not affected by the vulnerability.