Vulnerabilities > CVE-2019-5075 - Out-of-bounds Write vulnerability in Wago PFC 100 Firmware and PFC 200 Firmware
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
HIGH Integrity impact
HIGH Availability impact
HIGH Summary
An exploitable stack buffer overflow vulnerability exists in the command line utility getcouplerdetails of WAGO PFC200 Firmware versions 03.01.07(13) and 03.00.39(12), and WAGO PFC100 Firmware version 03.00.39(12). A specially crafted set of packets sent to the iocheckd service "I/O-Check" can cause a stack buffer overflow in the sub-process getcouplerdetails, resulting in code execution. An attacker can send unauthenticated packets to trigger this vulnerability.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| OS | 3 | |
| Hardware | 2 |
Common Weakness Enumeration (CWE)
Talos
| id | TALOS-2019-0864 |
| last seen | 2019-12-28 |
| published | 2019-12-16 |
| reporter | Talos Intelligence |
| source | http://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0864 |
| title | WAGO PFC200 iocheckd service "I/O-Check" get_coupler_details remote code execution vulnerability |