CVE-2019-5167

An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 version 03.02.02(14)

published March 10, 2020

CVSS
—
EPSS
1%
Percentile
68.1
In the wild
Unconfirmed
What it is

An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 version 03.02.02(14). At 0x1e3f0 the extracted dns value from the xml file is used as an argument to /etc/config-tools/edit_dns_server %s dns-server-nr=%d dns-server-name=<contents of dns node> using sprintf(). This command is later executed via a call to system(). This is done in a loop and there is no limit to how many dns entries will be parsed from the xml file.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01206 · 68.1th percentile
Published
2020-03-10T22:25Z
EPSS history
Timeline
  • 10 MAR 22:25Z
    An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 version 03.02.02(14)
    cvelistv5