CVE-2019-5181

CVE-2019-5181 affects WAGO PFC200 with the iocheckd service “I/O-Check.” A crafted cache file at /tmp/iocheckCache.xml is parsed by iocheckd, triggering stack-based buffer overflows via sscanf/sprintf usage in multiple config nodes (e.g., hostname, subnetmask, gateway, etc.). The root cause is un...

CVE-2019-5181

An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service ‘I/O-Check’ functionality of WAGO PFC 200 Firmware version 03.02.0214. A specially crafted XML cache file written to a specific location on the device can cause a stack buffer overflow, resulting in co...

CVE-2019-5180

An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service ‘I/O-Check’ functionality of WAGO PFC 200 Firmware version 03.02.0214. An attacker can send a specially crafted packet to trigger the parsing of this cache file. The destination buffer sp+0x440 is...

CVE-2019-5180

CVE-2019-5180 affects WAGO PFC200 via the iocheckd service (I/O-Check). Talos details show a stack-based buffer overflow while parsing the XML cache file (/tmp/iocheckCache.xml) used by iocheckd, with multiple vulnerable parameters (e.g., hostname, ip, gateway, domainname, ntp, subnet-mask, etc.)...

CVE-2019-5179

An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service ‘I/O-Check’ functionality of WAGO PFC 200 Firmware version 03.02.0214. An attacker can send a specially crafted packet to trigger the parsing of this cache file...

CVE-2019-5179

The CVE-2019-5179 entry concerns the WAGO PFC200 controller with firmware 03.02.02(14). The iocheckd service’s I/O-Check cache parsing (via the file /tmp/iocheckCache.xml) is vulnerable to a stack-based overflow triggered by crafted XML content, enabling code execution. Talos documents multiple c...

CVE-2019-5178

An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service ‘I/O-Check’ functionality of WAGO PFC 200 Firmware version 03.02.0214. An attacker can send a specially crafted packet to trigger the parsing of this cache file. The destination buffer sp+0x440 is...

CVE-2019-5178

CVE-2019-5178 affects WAGO PFC200 controllers (iocheckd) with a stack buffer overflow in the I/O-Check cache parsing workflow. The iocheckCache.xml hostname parameter can overflow a 1024-byte destination buffer via sprintf(), when hostname length exceeds a threshold (example provided 0x3fd). The ...

CVE-2019-5177

An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service ‘I/O-Check’ functionality of WAGO PFC 200 Firmware version 03.02.0214. The destination buffer sp+0x440 is overflowed with the call to sprintf for any domainname values that are greater than...

CVE-2019-5177

CVE-2019-5177 affects the WAGO PFC200 controller’s iocheckd service (I/O-Check) on firmware 03.02.02(14). The vulnerability is a stack buffer overflow in the iocheckd cache parsing when processing XML cache data; the destination buffer sp+0x440 can be overflowed via sprintf() with domainname valu...

CVE-2019-5176

CVE-2019-5176 affects WAGO PFC200, specifically the iocheckd service (I/O-Check) firmware 03.02.02(14). The issue is a stack buffer overflow when parsing a cache file (iocheckCache.xml) used by the iocheckd configuration protocol. Attackers can craft an XML cache file or gateway/hostname/domainna...

CVE-2019-5176

An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service ‘I/O-Check’ functionality of WAGO PFC 200 Firmware version 03.02.0214. An attacker can send a specially crafted packet to trigger the parsing of this cache file.The destination buffer sp+0x40 is...

CVE-2019-5171

The CVE-2019-5171 family targets WAGO PFC200 controllers, exploiting the iocheckd (I/O-Check) cache mechanism. Talos 2019-0962 documents that the iocheckCache.xml cache file (world-writable) is parsed during which multiple nodes (notably hostname and ip under /tmp/iocheckCache.xml) are used to bu...

CVE-2019-5171

An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 Firmware version 03.02.0214. An attacker can send specially crafted packet at 0x1ea48 to the extracted hostname value from the xml file that is used as an argument to...

CVE-2019-5170

CVE-2019-5170 (WAGO PFC200) affects the iocheckd “I/O-Check” caching component. The vulnerability arises while parsing a crafted XML cache file (iocheckCache.xml) placed in a writable location (notably /tmp). For the hostname node, the code uses its content in a call to sprintf to build a command...

CVE-2019-5170

An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 Firmware version 03.02.0214. A specially crafted XML cache file written to a specific location on the device can be used to inject OS commands. An attacker can send a specially...

CVE-2019-5169

An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 Firmware version 03.02.0214. A specially crafted XML cache file written to a specific location on the device can be used to inject OS commands. An attacker can send a specially...

CVE-2019-5169

CVE-2019-5169 affects WAGO PFC200 with firmware 03.02.02(14). The iocheckd “I/O-Check” service parses a writable XML cache (example path: /tmp/iocheckCache.xml) and builds commands via sprintf() using values like gateway, hostname, ip, dns, domain, etc. These commands are then executed by system(...

CVE-2019-5182

An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service ‘I/O-Check’ functionality of WAGO PFC 200 Firmware version 03.02.0214. An attacker can send a specially crafted packet to trigger the parsing of this cache file.The destination buffer sp+0x440 is...

CVE-2019-5182

An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service ‘I/O-Check’ functionality of WAGO PFC 200 Firmware version 03.02.0214. An attacker can send a specially crafted packet to trigger the parsing of this cache file.The destination buffer sp+0x440 is...