GCVE - cpe:2.3:a:wago:wago_pfc200_firmware:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:wago:wago_pfc200_firmware:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Wago (`32ab7757-de27-5378-a269-9c7ac714c35b`)
Product	Wago Pfc200 Firmware (`f40e5d3c-0d4e-5f99-ba73-45ea9405db2f`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2019-5174`	vulnerable	2026-06-08 05:13:57.789038	Details available An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 version 03.02.02(14). A specially crafted XML cache file written to a specific location on the device can be used to inject OS commands. An attacker can send a specially crafted packet to trigger the parsing of this cache file.At 0x1e9fc the extracted subnetmask value from the xml file is used as an argument to /etc/config-tools/config_interfaces interface=X1 state=enabled subnet-mask=<contents of subnetmask node> using sprintf(). This command is later executed via a call to system(). Published: 2020-03-11T22:25:04.000Z Updated: 2024-08-04T19:47:56.791Z Open on db.gcve.eu Reference links https://talosintelligence.com/vulnerability_reports/TALOS-2019-0962	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-5168`	vulnerable	2026-06-08 05:13:57.783588	Details available An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 version 03.02.02(14). An attacker can send a specially crafted XML cache file At 0x1e8a8 the extracted domainname value from the xml file is used as an argument to /etc/config-tools/edit_dns_server domain-name=<contents of domainname node> using sprintf().This command is later executed via a call to system(). Published: 2020-03-10T22:25:57.000Z Updated: 2024-08-04T19:47:56.825Z Open on db.gcve.eu Reference links https://talosintelligence.com/vulnerability_reports/TALOS-2019-0962	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-5167`	vulnerable	2026-06-08 05:13:57.783146	Details available An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 version 03.02.02(14). At 0x1e3f0 the extracted dns value from the xml file is used as an argument to /etc/config-tools/edit_dns_server %s dns-server-nr=%d dns-server-name=<contents of dns node> using sprintf(). This command is later executed via a call to system(). This is done in a loop and there is no limit to how many dns entries will be parsed from the xml file. Published: 2020-03-10T22:25:48.000Z Updated: 2024-08-04T19:47:56.596Z Open on db.gcve.eu Reference links https://talosintelligence.com/vulnerability_reports/TALOS-2019-0962	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-5166`	vulnerable	2026-06-08 05:13:57.782703	Details available An exploitable stack buffer overflow vulnerability exists in the iocheckd service ‘I/O-Check’ functionality of WAGO PFC 200 version 03.02.02(14). A specially crafted XML cache file written to a specific location on the device can cause a stack buffer overflow, resulting in code execution. An attacker can send a specially crafted packet to trigger the parsing of this cache file. Published: 2020-03-10T22:25:42.000Z Updated: 2024-08-04T19:47:56.751Z Open on db.gcve.eu Reference links https://talosintelligence.com/vulnerability_reports/TALOS-2019-0961	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-5161`	vulnerable	2026-06-08 05:13:57.777963	Details available An exploitable remote code execution vulnerability exists in the Cloud Connectivity functionality of WAGO PFC200 versions 03.02.02(14), 03.01.07(13), and 03.00.39(12). A specially crafted XML file will direct the Cloud Connectivity service to download and execute a shell script with root privileges. Published: 2020-03-10T23:32:14.000Z Updated: 2024-08-04T19:47:56.616Z Open on db.gcve.eu Reference links https://talosintelligence.com/vulnerability_reports/TALOS-2019-0954	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-5160`	vulnerable	2026-06-08 05:13:57.777425	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-5157`	vulnerable	2026-06-08 05:13:57.773488	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-5156`	vulnerable	2026-06-08 05:13:57.772993	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-5155`	vulnerable	2026-06-08 05:13:57.770971	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-5149`	vulnerable	2026-06-08 05:13:57.762630	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-5135`	vulnerable	2026-06-08 05:13:57.740763	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-5134`	vulnerable	2026-06-08 05:13:57.739643	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.