ByteOS Network

NVD Vulnerability Details :

CVE-2019-5155

Analyzed

Source-talos-cna@cisco.com

Published At-11 Mar, 2020 | 22:27

Updated At-17 Mar, 2020 | 18:05

An exploitable command injection vulnerability exists in the cloud connectivity feature of WAGO PFC200. An attacker can inject operating system commands into any of the parameter values contained in the firmware update command. This affects WAGO PFC200 Firmware version 03.02.02(14), version 03.01.07(13), and version 03.00.39(12)

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	7.2	HIGH	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary	2.0	9.0	HIGH	AV:N/AC:L/Au:S/C:C/I:C/A:C

CPE Matches

wago>>pfc200_firmware>>03.00.39\(12\)

cpe:2.3:o:wago:pfc200_firmware:03.00.39\(12\):*:*:*:*:*:*:*

wago>>pfc200_firmware>>03.01.07\(13\)

cpe:2.3:o:wago:pfc200_firmware:03.01.07\(13\):*:*:*:*:*:*:*

wago>>pfc200_firmware>>03.02.02\(14\)

cpe:2.3:o:wago:pfc200_firmware:03.02.02\(14\):*:*:*:*:*:*:*

wago>>pfc200>>-

cpe:2.3:h:wago:pfc200:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-78	Primary	nvd@nist.gov

References

Hyperlink	Source	Resource
https://talosintelligence.com/vulnerability_reports/TALOS-2019-0948	talos-cna@cisco.com	Exploit Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History