CVE-2019-5155

An exploitable command injection vulnerability exists in the cloud connectivity feature of WAGO PFC200. An attacker can inject operating system commands into any of the parameter values contained in the firmware update command. This affects WAGO PFC200 Firmware version 03.02.02(14), version 03.01.07(13), and version 03.00.39(12)

CVSS v3.1

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

9.0 HIGHAV:N/AC:L/Au:S/C:C/I:C/A:C

EPSS

4.61% chance of exploitation in the next 30 days, 91th percentile

Published

2020-03-10

Updated

2024-08-04

Proof-of-concept exploits (1)

• https://talosintelligence.com/vulnerability_reports/TALOS-2019-0948

References

• CVE Record
• NVD entry

Related

• CVE-2019-5153
• CVE-2019-5156
• CVE-2019-5152
• CVE-2019-5157
• CVE-2019-5151
• CVE-2019-5159