WAGO PFC200 03.02.02(14) iocheckd Service sprintf Crafted Packet out-of-bounds write

Summaryinfo

A vulnerability was found in WAGO PFC200 03.02.02(14). It has been classified as critical. This issue affects the function sprintf of the component iocheckd Service. The manipulation as part of Crafted Packet leads to out-of-bounds write. This vulnerability is documented as CVE-2019-5181. The attack needs to be performed locally. There is not any exploit available.

Detailsinfo

A vulnerability was found in WAGO PFC200 03.02.02(14) and classified as critical. This issue affects the function sprintf of the component iocheckd Service. The manipulation as part of a Crafted Packet leads to a out-of-bounds write vulnerability. Using CWE to declare the problem leads to CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service ‘I/O-Check’ functionality of WAGO PFC 200 Firmware version 03.02.02(14). A specially crafted XML cache file written to a specific location on the device can cause a stack buffer overflow, resulting in code execution. An attacker can send a specially crafted packet to trigger the parsing of this cache file. The destination buffer sp+0x440 is overflowed with the call to sprintf() for any subnetmask values that are greater than 1024-len(‘/etc/config-tools/config_interfaces interface=X1 state=enabled subnet-mask=‘) in length. A subnetmask value of length 0x3d9 will cause the service to crash.

The weakness was released 03/12/2020. The identification of this vulnerability is CVE-2019-5181 since 01/04/2019. Attacking locally is a requirement. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Entries connected to this vulnerability are available at VDB-151332, VDB-151330, VDB-151329 and VDB-151328. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• WAGO

Name

• PFC200

Version

• 03.02.02(14)

License

• commercial

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion