Skip to content
OpenAdvisories
Medium VDE-2019-017 1 CVE

WAGO: Series PFC100/PFC200 Information Disclosure

Published Sep 18, 2019 · Updated May 14, 2025 · Revision 4

Vendor: WAGO Product: 750-81xx/xxx-xxx Product: 750-82xx/xxx-xxx

Summary

The reported vulnerability allows a remote attacker to check paths and file names that are used in filesystem operations.

**Update, 18.9.2019, 18:30**

* fixed typo in modelname, replaced PCF with PFC.

Details

Impact
The vulnerability allows an attacker to check the existence of files via specially crafted HTTP requests. This can be potentially used to identify installed software and leak of sensitive data (e.g. session data stored in the file system).

Mitigation
* Restrict network access to the web server.
* Restrict network access to the device.
* Do not directly connect the device to the internet.

Remediation
Update your device to the latest firmware (>= FW12).

Vulnerabilities 1

  • Medium 5.8
    CVE-2019-18202

    Information Disclosure is possible on WAGO Series PFC100 and PFC200 devices before FW12 due to improper access control.…

Revision history

  1. #4

    Fix: version space, added distribution

  2. #3

    Fix: correct certvde domain, added alias, added self-reference

  3. #2

    Fixed typo.

  4. #1

    Initial revision.

References