Description
An exploitable remote code execution vulnerability exists in the Cloud Connectivity functionality of WAGO PFC200 versions 03.02.02(14), 03.01.07(13), and 03.00.39(12). A specially crafted XML file will direct the Cloud Connectivity service to download and execute a shell script with root privileges.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Wago | WAGO PFC200 Firmware | version 03.02.02(14), version 03.01.07(13), version 03.00.39(12) | — |
Advisories 1
- VDE-2020-010 WAGO: Cloud Connectivity Remote Code Execution Vulnerability CERT@VDE · Mar 9, 2020