CVE-2019-5161: wago pfc200_firmware
Vulnerability summary
CVE-2019-5161 is a critical (CVSS 9.1) vulnerability in wago pfc200_firmware. EPSS estimates a 2.51% chance of exploitation in the next 30 days, higher than 84.6% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 10-03-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
An exploitable remote code execution vulnerability exists in the Cloud Connectivity functionality of WAGO PFC200 versions 03.02.02(14), 03.01.07(13), and 03.00.39(12). A specially crafted XML file will direct the Cloud Connectivity service to download and execute a shell script with root privileges.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
2.51%
Chance of exploitation in the next 30 days
Percentile
85%
Versus all other CVEs
30-day change
0.00 pp
From 2.51% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (talosintelligence.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Wago2 products
- pfc200_firmware03.00.39\(12\) | 03.01.07\(13\) | 03.02.02\(14\)
- wago pfc200 firmwareversion 03.02.02(14) | version 03.01.07(13) | version 03.00.39(12)
1 vendor · 2 products
References
1 links- talosintelligence.com/vulnerability_reports/TALOS-2019-0954X Refsource MISCExploitMitigationThird Party Advisory