WAGO: PFC200 Access to files outside the home directory
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 03.06.19 (18)
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
On WAGO PFC200 devices in different firmware versions with special crafted packets an authorised attacker with network access to the device can access the file system with higher privileges.
Timeline
- CVE published
- Record last updated
Affected versions
- WAGO Series PFC200 Controller
From 750-823 · through FW07; From 750-829 · through FW14; From 750-831/000-00x · through FW14; From 750-832/000-00x · through FW06; From 750-852 · through FW14; From 750-862 · through FW07; From 750-880/0xx-xxx · through FW15; From 750-881 · through FW14; From 750-882 · through FW14; From 750-885/0xx-xxx · through FW14; From 750-889 · through FW14; From 750-890/0xx-xxx · through FW07; From 750-891 · through FW07; From 750-893 · through FW07
- WAGO Series Ethernet Controller
From 750-8202/xxx-xxx · fixed in 03.06.19 (18); From 750-8203/xxx-xxx · fixed in 03.06.19 (18); From 750-8204/xxx-xxx · fixed in 03.06.19 (18); From 750-8206/xxx-xxx · fixed in 03.06.19 (18); From 750-8207/xxx-xxx · fixed in 03.06.19 (18); From 750-8208/xxx-xxx · fixed in 03.06.19 (18); From 750-8210/xxx-xxx · fixed in 03.06.19 (18); From 750-8211/xxx-xxx · fixed in 03.06.19 (18); From 750-8212/xxx-xxx · fixed in 03.06.19 (18); From 750-8213/xxx-xxx · fixed in 03.06.19 (18); From 750-8214/xxx-xxx · fixed in 03.06.19 (18); From 750-8216/xxx-xxx · fixed in 03.06.19 (18); From 750-8217/xxx-xxx · fixed in 03.06.19 (18)