CVSS: 5.9EPSS: 0%CPEs: 14EXPL: 0CVE-2022-3738 – WAGO: Missing authentication for config export functionality in multiple products
https://notcve.org/view.php?id=CVE-2022-3738
The vulnerability allows a remote unauthenticated attacker to download a backup file, if one exists. That backup file might contain sensitive information like credentials and cryptographic material. A valid user has to create a backup after the last reboot for this attack to be successfull. La vulnerabilidad permite a un atacante remoto no autenticado descargar un archivo de copia de seguridad, si existe. Ese archivo de copia de seguridad puede contener información confidencial, como credenciales y material criptográfico. • https://cert.vde.com/en/advisories/VDE-2022-054 • CWE-306: Missing Authentication for Critical Function •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 0CVE-2020-6090
https://notcve.org/view.php?id=CVE-2020-6090
An exploitable code execution vulnerability exists in the Web-Based Management (WBM) functionality of WAGO PFC 200 03.03.10(15). A specially crafted series of HTTP requests can cause code execution resulting in remote code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability. Se presenta una vulnerabilidad de ejecución de código explotable en la funcionalidad Web-Based Management (WBM) de WAGO PFC 200 versión 03.03.10 (15). Una serie especialmente diseñada de peticiones HTTP puede causar una ejecución de código resultando en una ejecución de código remota. • https://talosintelligence.com/vulnerability_reports/TALOS-2020-1010 • CWE-345: Insufficient Verification of Data Authenticity •
CVSS: 7.0EPSS: 0%CPEs: 2EXPL: 1CVE-2019-5185
https://notcve.org/view.php?id=CVE-2019-5185
An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service "I/O-Check" functionality of WAGO PFC 200. An attacker can send a specially crafted packet to trigger the parsing of this cache file. At 0x1ea28 the extracted state value from the xml file is used as an argument to /etc/config-tools/config_interfaces interface=X1 state=<contents of state node> using sprintf(). The destination buffer sp+0x40 is overflowed with the call to sprintf() for any state values that are greater than 512-len("/etc/config-tools/config_interfaces interface=X1 state=") in length. Later, at 0x1ea08 strcpy() is used to copy the contents of the stack buffer that was overflowed sp+0x40 into sp+0x440. • https://talosintelligence.com/vulnerability_reports/TALOS-2019-0966 • CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 1CVE-2019-5184
https://notcve.org/view.php?id=CVE-2019-5184
An exploitable double free vulnerability exists in the iocheckd service "I/O-Check" functionality of WAGO PFC 200. A specially crafted XML cache file written to a specific location on the device can cause a heap pointer to be freed twice, resulting in a denial of service and potentially code execution. An attacker can send a specially crafted packet to trigger the parsing of this cache file. Se presenta una vulnerabilidad de doble liberación explotable en la funcionalidad "I/O-Check" del servicio iocheckd de WAGO PFC 200. Un archivo caché XML especialmente diseñado y escrito en una ubicación específica en el dispositivo puede causar que un puntero de la pila sea dos veces liberado, resultando en un denegación de servicio y potencialmente en ejecución de código. • https://talosintelligence.com/vulnerability_reports/TALOS-2019-0965 • CWE-415: Double Free •
CVSS: 7.0EPSS: 0%CPEs: 2EXPL: 1CVE-2019-5186
https://notcve.org/view.php?id=CVE-2019-5186
An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service "I/O-Check" functionality of WAGO PFC 200. An attacker can send a specially crafted packet to trigger the parsing of this cache file.At 0x1eb9c the extracted interface element name from the xml file is used as an argument to /etc/config-tools/config_interfaces interface=<contents of interface element> using sprintf(). The destination buffer sp+0x40 is overflowed with the call to sprintf() for any interface values that are greater than 512-len("/etc/config-tools/config_interfaces interface=") in length. Later, at 0x1ea08 strcpy() is used to copy the contents of the stack buffer that was overflowed sp+0x40 into sp+0x440. The buffer sp+0x440 is immediately adjacent to sp+0x40 on the stack. • https://talosintelligence.com/vulnerability_reports/TALOS-2019-0966 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •