CVE-2019-5182: Buffer Overflow

Published Mar 11, 2020

Updated

An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service ‘I/O-Check’ functionality of WAGO PFC 200 Firmware version 03.02.02(14). An attacker can send a specially crafted packet to trigger the parsing of this cache file.The destination buffer sp+0x440 is overflowed with the call to sprintf() for any type values that are greater than 1024-len(‘/etc/config-tools/configinterfaces interface=X1 state=enabled config-type=‘) in length. A type value of length 0x3d9 will cause the service to crash.

Affected Software

2 affected components

WAGO PFC200 Firmware=03.02.02\(14\)

WAGO PFC200

Event History

Mar 11, 2020

CVE Published

via MITRE·10:09 PM

Data Sourced

via MITRE·10:09 PM

DescriptionWeakness

Frequently Asked Questions

What is CVE-2019-5182?

CVE-2019-5182 is an exploitable stack buffer overflow vulnerability in the iocheckd service 'I/O-Check' functionality of WAGO PFC 200 Firmware version 03.02.02(14).

How severe is CVE-2019-5182?

CVE-2019-5182 has a severity rating of 5.5, which is considered medium.

How does CVE-2019-5182 affect WAGO PFC 200 Firmware?

CVE-2019-5182 affects WAGO PFC 200 Firmware version 03.02.02(14).

How can CVE-2019-5182 be exploited?

CVE-2019-5182 can be exploited by sending a specially crafted packet to trigger the parsing of a cache file in the iocheckd service.

Is WAGO PFC200 vulnerable to CVE-2019-5182?

No, WAGO PFC200 is not vulnerable to CVE-2019-5182.