Vulnerability · Published Dec 17, 2020 · Assigned by CERTVDE
CVE-2020-12522Command Injection Vulnerability in I/O-Check Service of WAGO PFC100, PFC200 and Touch Panel 600 Series with firmware versions <=FW10
Critical 10.0
In plain English
A critical-severity OS command injection in Series PFC 100 (750-81xx/xxx-xxx) from WAGO. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.1% (higher than 88% of all known vulnerabilities).
Official description
The reported vulnerability allows an attacker who has network access to the device to execute code with specially crafted packets in WAGO Series PFC 100 (750-81xx/xxx-xxx), Series PFC 200 (750-82xx/xxx-xxx), Series Wago Touch Panel 600 Standard Line (762-4xxx), Series Wago Touch Panel 600 Advanced Line (762-5xxx), Series Wago Touch Panel 600 Marine Line (762-6xxx) with firmware versions <=FW10.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| WAGO | Series PFC 100 (750-81xx/xxx-xxx) | FW1 – through FW10 |
| WAGO | Series PFC 200 (750-82xx/xxx-xxx) | FW1 – through FW10 |
| WAGO | Series Wago Touch Panel 600 Standard Line (762-4xxx) | FW1 – through FW10 |
| WAGO | Series Wago Touch Panel 600 Advanced Line (762-5xxx) | FW1 – through FW10 |
| WAGO | Series Wago Touch Panel 600 Marine Line (762-6xxx) | FW1 – through FW10 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- https://cert.vde.com/en-us/advisories/vde-2020-045 x_refsource_CONFIRM