CVE-2019-5167

An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 version 03.02.0214. At 0x1e3f0 the extracted dns value from the xml file is used as an argument to /etc/config-tools/editdnsserver %s dns-server-nr=%d dns-server-name= using...

CVE-2019-5175

WAGO PFC200 iocheckd vulnerability (CVE-2019-5175) affects the iocheckd (I/O-Check) service. The issue arises from parsing a crafted XML cache file stored at /tmp/iocheckCache.xml, where user-controlled values are fed into /etc/config-tools commands via sprintf() and later executed with system(),...

CVE-2019-5173

An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 Firmware version 03.02.0214. A specially crafted XML cache file written to a specific location on the device can be used to inject OS commands. An attacker can send a specially...

WAGO PFC 200 Buffer Overflow Vulnerability (CNVD-2020-16628)

The WAGO PFC 200 is a programmable logic controller PLC from the German company WAGO. A buffer overflow vulnerability exists in the I/O-Check function of the iocheckd service in the WAGO PFC 200. An attacker can exploit this vulnerability to cause a denial of service or possibly execute code with...

WAGO PFC 200 Buffer Overflow Vulnerability

The WAGO PFC 200 is a programmable logic controller PLC from the German company WAGO. A buffer overflow vulnerability exists in the I/O-Check function in the WAGO PFC 200. The vulnerability originates when a networked system or product performs an operation on memory without properly validating...