CVE-2019-5077

CWE-306 — Missing AuthenticationCWE-284 — Improper Access Control4 documents4 sources
Severity
9.1CRITICAL
EPSS
0.6%
top 30.64%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Wago PFC 100 FirmwareWago PFC 200 Firmware
Timeline
PublishedDec 18
Latest updateMay 24

Description

An exploitable denial-of-service vulnerability exists in the iocheckd service ‘’I/O-Chec’’ functionality of WAGO PFC 200 Firmware versions 03.01.07(13) and 03.00.39(12), and WAGO PFC 100 Firmware version 03.00.39(12). A specially crafted set of packets can cause a denial of service, resulting in the device entering an error state where it ceases all network communications. An attacker can send unauthenticated packets to trigger this vulnerability.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:HExploitability: 3.9 | Impact: 5.2

Affected Packages4 packages

▶NVDwago/pfc_100_firmware03.00.39\(12\)
▶NVDwago/pfc_200_firmware03.00.39\(12\), 03.01.07\(13\)+1
▶CVEListV5wago_pfc100Firmware version 03.00.39(12)
▶CVEListV5wago_pfc200Firmware version 03.00.39(12), Firmware version 03.01.07(13)+1

🔴Vulnerability Details

2
GHSA
GHSA-wg4r-4x32-rpwp: An exploitable denial-of-service vulnerability exists in the iocheckd service ??I/O-Chec?? functionality of WAGO PFC 200 Firmware versions 03↗2022-05-24
▶
CVEList
CVE-2019-5077: An exploitable denial-of-service vulnerability exists in the iocheckd service ‘’I/O-Chec’’ functionality of WAGO PFC 200 Firmware versions 03↗2019-12-18
▶

📋Vendor Advisories

1
Red Hat
hw: Intel GPU blitter manipulation can allow for arbitrary kernel memory write↗2019-11-12
▶
CVE-2019-5077 (CRITICAL CVSS 9.1) | An exploitable denial-of-service vu | cvebase.io