Details of VAR-201912-0773

ID

VAR-201912-0773

CVE

CVE-2019-5074

TITLE

WAGO PFC 200 and PFC100 Classic buffer overflow vulnerability in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2019-013796

DESCRIPTION

An exploitable stack buffer overflow vulnerability exists in the iocheckd service ''I/O-Check'' functionality of WAGO PFC200 Firmware version 03.01.07(13), WAGO PFC200 Firmware version 03.00.39(12) and WAGO PFC100 Firmware version 03.00.39(12). A specially crafted set of packets can cause a stack buffer overflow, resulting in code execution. An attacker can send unauthenticated packets to trigger this vulnerability. WAGO PFC 200 and PFC100 The firmware contains a classic buffer overflow vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. WAGO PFC 200 is a programmable logic controller (PLC) from the German company WAGO. A buffer overflow vulnerability exists in the I / O-Check function in WAGO PFC 200. The vulnerability originates from a network system or product that incorrectly validates data boundaries when performing operations on memory, causing incorrect read and write operations to be performed on other associated memory locations. An attacker could use this vulnerability to cause a buffer overflow or heap overflow

Trust: 2.16

sources: NVD: CVE-2019-5074 // JVNDB: JVNDB-2019-013796 // CNVD: CNVD-2020-03549

IOT TAXONOMY

category:

['ICS', 'Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2020-03549

AFFECTED PRODUCTS

vendor:	wago	model:	pfc100	scope:	eq	version:	03.00.39(12)	Trust: 1.4
vendor:	wago	model:	pfc 100	scope:	eq	version:	03.00.39\(12\)	Trust: 1.0
vendor:	wago	model:	pfc 200	scope:	eq	version:	03.01.07\(13\)	Trust: 1.0
vendor:	wago	model:	pfc200	scope:	eq	version:	03.00.39(12)	Trust: 0.8
vendor:	wago	model:	pfc200	scope:	eq	version:	03.01.07(13)	Trust: 0.8
vendor:	wago	model:	pfc	scope:	eq	version:	20003.01.07(13)	Trust: 0.6
vendor:	wago	model:	pfc	scope:	eq	version:	20003.00.39(12)	Trust: 0.6

sources: CNVD: CNVD-2020-03549 // JVNDB: JVNDB-2019-013796 // NVD: CVE-2019-5074

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-5074
value:	CRITICAL
Trust: 1.0
NVD:	CVE-2019-5074
value:	CRITICAL
Trust: 0.8
CNVD:	CNVD-2020-03549
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-201912-747
value:	CRITICAL
Trust: 0.6

nvd@nist.gov:	CVE-2019-5074
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2020-03549
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2019-5074
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	CVE-2019-5074
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2020-03549 // JVNDB: JVNDB-2019-013796 // CNNVD: CNNVD-201912-747 // NVD: CVE-2019-5074

PROBLEMTYPE DATA

problemtype:	CWE-787	Trust: 1.0
problemtype:	CWE-120	Trust: 0.8

sources: JVNDB: JVNDB-2019-013796 // NVD: CVE-2019-5074

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201912-747

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-201912-747

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-013796

PATCH

title:	Top Page	url:	https://www.wago.com/us/	Trust: 0.8
title:	WAGO PFC 200 and WAGO PFC100 Buffer error vulnerability fix	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=106024	Trust: 0.6

sources: JVNDB: JVNDB-2019-013796 // CNNVD: CNNVD-201912-747

EXTERNAL IDS

db:	TALOS	id:	TALOS-2019-0863	Trust: 3.0
db:	NVD	id:	CVE-2019-5074	Trust: 3.0
db:	JVNDB	id:	JVNDB-2019-013796	Trust: 0.8
db:	CNVD	id:	CNVD-2020-03549	Trust: 0.6
db:	ICS CERT	id:	ICSA-20-065-01	Trust: 0.6
db:	AUSCERT	id:	ESB-2020.0842	Trust: 0.6
db:	CNNVD	id:	CNNVD-201912-747	Trust: 0.6

sources: CNVD: CNVD-2020-03549 // JVNDB: JVNDB-2019-013796 // CNNVD: CNNVD-201912-747 // NVD: CVE-2019-5074

REFERENCES

url:	https://talosintelligence.com/vulnerability_reports/talos-2019-0863	Trust: 2.4
url:	https://nvd.nist.gov/vuln/detail/cve-2019-5074	Trust: 1.4
url:	https://www.talosintelligence.com/vulnerability_reports/talos-2019-0863	Trust: 1.2
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-5074	Trust: 0.8
url:	https://www.us-cert.gov/ics/advisories/icsa-20-065-01	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/esb-2020.0842/	Trust: 0.6

sources: CNVD: CNVD-2020-03549 // JVNDB: JVNDB-2019-013796 // CNNVD: CNNVD-201912-747 // NVD: CVE-2019-5074

CREDITS

Discovered by Kelly Leuschner of Cisco Talos

Trust: 0.6

sources: CNNVD: CNNVD-201912-747

SOURCES

db:	CNVD	id:	CNVD-2020-03549
db:	JVNDB	id:	JVNDB-2019-013796
db:	CNNVD	id:	CNNVD-201912-747
db:	NVD	id:	CVE-2019-5074

LAST UPDATE DATE

2024-11-23T21:51:49.152000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2020-03549	date:	2020-02-04T00:00:00
db:	JVNDB	id:	JVNDB-2019-013796	date:	2020-01-16T00:00:00
db:	CNNVD	id:	CNNVD-201912-747	date:	2021-07-26T00:00:00
db:	NVD	id:	CVE-2019-5074	date:	2024-11-21T04:44:18.047

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2020-03549	date:	2020-02-04T00:00:00
db:	JVNDB	id:	JVNDB-2019-013796	date:	2020-01-16T00:00:00
db:	CNNVD	id:	CNNVD-201912-747	date:	2019-12-16T00:00:00
db:	NVD	id:	CVE-2019-5074	date:	2019-12-18T20:15:16.760