CVE-2019-5156

CVE-2019-5156 affects WAGO PFC200 controllers (firmware v03.02.02(14), v03.01.07(13), v03.00.39(12)) in the Cloud Connectivity service. The vulnerability stems from passing a user-supplied value from the Firmware Update command’s TimeoutPrepared parameter into a shell command via “settimeout -c …...

CVE-2019-5157

An exploitable command injection vulnerability exists in the Cloud Connectivity functionality of WAGO PFC200 Firmware versions 03.02.0214, 03.01.0713, and 03.00.3912. An attacker can inject OS commands into the TimeoutUnconfirmed parameter value contained in the Firmware Update command...

CVE-2019-5157

CVE-2019-5157 affects WAGO PFC200 Cloud Connectivity. The vulnerability arises from the TimeoutUnconfirmed parameter in the Firmware Update command, which is not properly escaped and is appended to a shell command, leading to OS command injection when processed by /etc/config-tools/fwupdate and t...

CVE-2019-5160

An exploitable improper host validation vulnerability exists in the Cloud Connectivity functionality of WAGO PFC200 Firmware versions 03.02.0214, 03.01.0713, and 03.00.3912. A specially crafted HTTPS POST request can cause the software to connect to an unauthorized host, resulting in unauthorized...

CVE-2019-5160

The CVE-2019-5160 issue affects WAGO PFC200 firmware (03.02.02(14), 03.01.07(13), 03.00.39(12)) via the Cloud Connectivity service. A crafted authenticated HTTPS POST can cause the device to connect to an attacker‑controlled Azure IoT Hub, enabling unauthorized access to the firmware update funct...

CVE-2019-5155

An exploitable command injection vulnerability exists in the cloud connectivity feature of WAGO PFC200. An attacker can inject operating system commands into any of the parameter values contained in the firmware update command. This affects WAGO PFC200 Firmware version 03.02.0214, version...

CVE-2019-5155

An exploitable command injection vulnerability exists in the cloud connectivity feature of WAGO PFC200. An attacker can inject operating system commands into any of the parameter values contained in the firmware update command. This affects WAGO PFC200 Firmware version 03.02.0214, version...

PT-2020-11078

Name of the Vulnerable Software and Affected Versions WAGO PFC200 versions 03.00.3912 through 03.02.0214 Description An exploitable command injection issue exists in the cloud connectivity feature. This allows an attacker to inject operating system commands into parameter values contained in the...

CVE-2019-5160: Undefined Security Weakness

An exploitable improper host validation vulnerability exists in the Cloud Connectivity functionality of WAGO PFC200 Firmware versions 03.02.0214, 03.01.0713, and 03.00.3912. A specially crafted HTTPS POST request can cause the software to connect to an unauthorized host, resulting in unauthorized...

PT-2020-11079

Name of the Vulnerable Software and Affected Versions WAGO PFC200 versions 03.00.3912 through 03.02.0214 Description An exploitable command injection issue exists in the cloud connectivity functionality. An attacker can inject operating system commands into the TimeoutPrepared parameter value...

CVE-2019-5161: Insufficient Verification of Data Authenticity

An exploitable remote code execution vulnerability exists in the Cloud Connectivity functionality of WAGO PFC200 versions 03.02.0214, 03.01.0713, and 03.00.3912. A specially crafted XML file will direct the Cloud Connectivity service to download and execute a shell script with root privileges...

PT-2020-11083

Name of the Vulnerable Software and Affected Versions WAGO PFC200 Firmware versions 03.02.0214, 03.01.0713, and 03.00.3912 Description An improper host validation issue exists in the Cloud Connectivity functionality, allowing a specially crafted HTTPS POST request to cause the software to connect...

PT-2020-11080

Name of the Vulnerable Software and Affected Versions WAGO PFC200 Firmware versions 03.00.3912 through 03.02.0214 Description An exploitable command injection issue exists in the Cloud Connectivity functionality. An attacker can inject OS commands into the TimeoutUnconfirmed parameter value...

PT-2020-11084

Name of the Vulnerable Software and Affected Versions WAGO PFC200 versions 03.00.3912 through 03.02.0214 Description A remote code execution issue exists in the Cloud Connectivity functionality. This is due to a specially crafted XML file that directs the Cloud Connectivity service to download an...

WAGO PFC200 Cloud Connectivity Remote Code Execution Vulnerability

Summary An exploitable remote code execution vulnerability exists in the Cloud Connectivity functionality of WAGO PFC200. A specially crafted XML file will direct the Cloud Connectivity service to download and execute a shell script with root privileges. Tested Versions WAGO PFC200 Firmware versi...

WAGO PFC200 Cloud Connectivity TimeoutPrepared Command Injection Vulnerability

Summary An exploitable command injection vulnerability exists in the cloud connectivity functionality of WAGO PFC200. An attacker can inject operating system commands into the TimeoutPrepared parameter value contained in the firmware update command. Tested Versions WAGO PFC200 Firmware version...

WAGO PFC200 Cloud Connectivity TimeoutUnconfirmed Command Injection Vulnerability

Summary An exploitable command injection vulnerability exists in the Cloud Connectivity functionality of WAGO PFC200. An attacker can inject OS commands into the TimeoutUnconfirmed parameter value contained in the Firmware Update command. Tested Versions WAGO PFC200 Firmware version 03.02.0214 WA...

WAGO PFC200 Cloud Connectivity Multiple Command Injection Vulnerabilities

Summary An exploitable command injection vulnerability exists in the cloud connectivity feature of WAGO PFC200. An attacker can inject operating system commands into any of the parameter values contained in the firmware update command. Tested Versions WAGO PFC200 Firmware version 03.02.0214 WAGO...

WAGO PFC200 Cloud Connectivity Improper Host Validation Vulnerability

Summary An exploitable improper host validation vulnerability exists in the Cloud Connectivity functionality of WAGO PFC200. A specially crafted HTTPS POST request can cause the software to connect to an unauthorized host, resulting in unauthorized access to firmware update functionality. An...