Description
An exploitable command injection vulnerability exists in the cloud connectivity functionality of WAGO PFC200 versions 03.02.02(14), 03.01.07(13), and 03.00.39(12). An attacker can inject operating system commands into the TimeoutPrepared parameter value contained in the firmware update command.
References (1)
Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://talosintelligence.com/vulnerability_reports/TALOS-2019-0949
Scores
CVSS v3
7.2
EPSS
0.0418
EPSS Percentile
89.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-78
Status
published
Products (3)
wago/pfc200_firmware
03.00.39\(12\)
wago/pfc200_firmware
03.01.07\(13\)
wago/pfc200_firmware
03.02.02\(14\)
Published
Mar 11, 2020
Tracked Since
Feb 18, 2026