CVE-2019-5167 in PFC200
Summary
by MITRE
An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 version 03.02.02(14). At 0x1e3f0 the extracted dns value from the xml file is used as an argument to /etc/config-tools/edit_dns_server %s dns-server-nr=%d dns-server-name=<contents of dns node> using sprintf(). This command is later executed via a call to system(). This is done in a loop and there is no limit to how many dns entries will be parsed from the xml file.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 05/11/2025
The vulnerability described in CVE-2019-5167 represents a critical command injection flaw within the iocheckd service of WAGO PFC 200 industrial control devices running firmware version 03.02.02(14). This issue resides in the I/O-Check functionality where the system processes XML configuration files containing DNS server entries. The vulnerability stems from improper input validation and sanitization of the dns value extracted from the XML file, creating a dangerous condition where user-supplied data directly influences command execution. The flaw manifests at memory address 0x1e3f0 where the extracted DNS value is formatted into a command string using sprintf() function without adequate sanitization measures. This command string subsequently gets executed through a system() call, creating a classic command injection scenario that allows attackers to execute arbitrary code on the affected device.
The technical implementation of this vulnerability follows a predictable pattern that aligns with CWE-78, which specifically addresses improper neutralization of special elements used in OS commands. The system parses DNS entries from XML configuration files in a loop without imposing any limits on the number of entries processed, creating an environment where malicious input can be amplified through multiple iterations. The sprintf() function concatenates the unsanitized dns value directly into the command string that eventually gets passed to system(), eliminating any form of input validation or escaping. This design flaw enables attackers to inject malicious commands that will be executed with the privileges of the iocheckd service, typically running with elevated system permissions. The lack of input limits and the repetitive parsing loop means that a single malicious XML file could contain multiple command injection payloads, each executing sequentially within the same vulnerable function.
The operational impact of this vulnerability extends far beyond simple code execution, as it provides attackers with complete control over the industrial control device. Since WAGO PFC 200 devices are commonly deployed in critical infrastructure environments including manufacturing plants, power grids, and industrial automation systems, this vulnerability could enable attackers to compromise entire industrial networks. The command injection could be used to establish persistent backdoors, exfiltrate sensitive operational data, modify device configurations, or even disrupt critical industrial processes. The vulnerability's exploitation does not require authentication, making it particularly dangerous as it can be triggered through unauthenticated network access. This aligns with ATT&CK technique T1059.001 for Command and Scripting Interpreter, where adversaries execute commands through legitimate system interfaces. The impact is further amplified by the fact that these devices often operate in isolated networks where traditional security controls may be insufficient.
Mitigation strategies for CVE-2019-5167 must address both the immediate vulnerability and broader security posture of industrial control systems. The primary solution involves implementing proper input validation and sanitization of all user-supplied data before it is processed by system commands. This includes using parameterized commands instead of string concatenation, implementing strict input length limits, and employing proper escaping mechanisms for special characters. Organizations should also implement network segmentation to limit access to industrial control devices and deploy intrusion detection systems specifically designed for industrial environments. Firmware updates from WAGO should be applied immediately to address this vulnerability, as the company has released patches to fix the command injection flaw. Additionally, security monitoring should be enhanced to detect unusual command execution patterns and unauthorized configuration changes. The vulnerability highlights the importance of applying principle of least privilege to industrial control services and implementing robust configuration management practices to prevent unauthorized modifications to critical system files.