CVE-2019-5079
highpriority · track · 40EPSS 0.033 · 89 %ileDEEUUSEPSS · scored 2026-10-27
An exploitable heap buffer overflow vulnerability exists in the iocheckd service "I/O-Check" functionality of WAGO PFC200 Firmware versions 03.01.07(13) and 03.00.39(12), and WAGO PFC100 Firmware version 03.00.39(12). A specially crafted set of packets can cause a heap buffer overflow, potentially resulting in code execution. An attacker can send unauthenticated packets to trigger this vulnerability.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- Fixedwago_psirt
The I/O-Check service protocol is only needed during installation and commissioning, not during normal operations. It is highly recommended to disable the IP-port 6626 after commissioning. This is the easiest and securest way to protect your device for the listed vulnerabilities and for upcoming zero day exploits. Regardless of the action described above, the following CVEs can be fixed alternatively by a firmware update >= FW 15. CVE-2019-5073 CVE-2019-5074 CVE-2019-5075 CVE-2019-5079 CVE-2019-5081 CVE-2019-5082
- Mitigationwago_psirt
Restrict network access to the device. Do not directly connect the device to the internet. Disable unused TCP/UDP-ports
- MitigationI/O-CHECK Series PFC100 and Series PFC200cisa_csaf_ot
Disable unused TCP/UDP-ports.
- MitigationSeries PFC100cisa_csaf_ot
Disable unused TCP/UDP-ports.
- MitigationSeries PFC200cisa_csaf_ot
Disable unused TCP/UDP-ports.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.5–10
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (37)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- VDE-2019-022WAGO: Multiple Vulnerabilities in I/O-Check Service in Multiple Devices2019-12-16csaf · wago_psirtDE
The reported vulnerabilities allow a remote attacker to change the setting, delete the application, set the device to factory defaults, code execution and to cause a system crash or denial of service. Note(s) The following products are affected by the listed vulnerabilities: Series PFC100 (750-81xx/xxx-xxx) Series PFC200 (750-82xx/xxx-xxx) The following products are affected by the vulnerability CVE-2019-5078 750-852, 750-831/xxx-xxx, 750-881, 750-880/xxx-xxx, 750-889 750-823, 750-832/xxx-xxx, 750-862, 750-890/xxx-xxx, 750-891
- ICSA-20-065-01WAGO I/O-CHECK2020-03-05icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could allow an attacker to change settings, delete the application, run remote code, cause a system crash, cause a denial-of-service condition, revert to factory settings, and overwrite MAC addresses.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (7)
External citations — patches, advisories, analysis.
- https://nvd.nist.gov/vuln/detail/CVE-2019-5079cnnvd
- https://www.auscert.org.au/bulletins/ESB-2020.0842/cnnvd
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0871cnnvd
- https://www.us-cert.gov/ics/advisories/icsa-20-065-01cnnvd
- https://www.wago.comPatchcnnvd
- https://talosintelligence.com/vulnerability_reports/TALOS-2019-0871enisa_euvd
- https://talosintelligence.com/vulnerability_reports/TALOS-2019-0871ExploitThird Party Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan