Lucene search
TalosCVELIST:CVE-2019-5159HistoryMar 10, 2020 - 10:35 p.m.
CVE-2019-5159
2020-03-1022:35:47
talos
www.cve.org
4
EPSS
0.001
Percentile
41.0%
An exploitable improper input validation vulnerability exists in the firmware update functionality of WAGO e!COCKPIT automation software v1.6.0.7. A specially crafted firmware update file can allow an attacker to write arbitrary files to arbitrary locations on WAGO controllers as a part of executing a firmware update, potentially resulting in code execution. An attacker can create a malicious firmware update package file using any zip utility. The user must initiate a firmware update through e!COCKPIT and choose the malicious wup file using the file browser to trigger the vulnerability.
CNA Affected
[
{
"product": "WAGO e!COCKPIT",
"vendor": "Wago",
"versions": [
{
"status": "affected",
"version": "1.6.0.7"
}
]
}
]Related
nvd
nvd
CVE-2019-5159
2020-03-11 22:27:41
prion
prion
Input validation
2020-03-11 22:27:00
cve
cve
CVE-2019-5159
2020-03-11 22:27:41
talos
talos
WAGO e!COCKPIT file path improper input validation vulnerability
2020-03-09 00:00:00