CVE-2019-5160
CVE-2019-5160 is a critical-severity vulnerability in Wago Pfc200 Firmware with a CVSS 3.x base score of 9.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.
Key facts
- Severity: Critical (CVSS 3.x base score 9.1)
- CVSS v2: 6.5
- EPSS exploit prediction: 3% (84th percentile)
- Actively exploited: Not listed in CISA KEV
- Affected product: Wago Pfc200 Firmware
- Published:
- Last modified:
Description
An exploitable improper host validation vulnerability exists in the Cloud Connectivity functionality of WAGO PFC200 Firmware versions 03.02.02(14), 03.01.07(13), and 03.00.39(12). A specially crafted HTTPS POST request can cause the software to connect to an unauthorized host, resulting in unauthorized access to firmware update functionality. An attacker can send an authenticated HTTPS POST request to direct the Cloud Connectivity software to connect to an attacker controlled Azure IoT Hub node.
Frequently asked questions
- What is CVE-2019-5160?
- An exploitable improper host validation vulnerability exists in the Cloud Connectivity functionality of WAGO PFC200 Firmware versions 03.02.02(14), 03.01.07(13), and 03.00.39(12). A specially crafted HTTPS POST request can cause the software to connect to an unauthorized host, resulting in unauthorized access to firmware update functionality. An attacker can send an authenticated HTTPS POST request to direct the Cloud Connectivity software to connect to an attacker controlled Azure IoT Hub node.
- How severe is CVE-2019-5160?
- CVE-2019-5160 has a CVSS 3.x base score of 9.1, rated critical severity. It is exploitable over network with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
- Is CVE-2019-5160 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 3% (84th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2019-5160?
- CVE-2019-5160 primarily affects Wago Pfc200 Firmware. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2019-5160?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
- When was CVE-2019-5160 published?
- CVE-2019-5160 was published on 2020-03-11 and last updated on 2026-06-17.
References
Affected products (3)
- cpe:2.3:o:wago:pfc200_firmware:03.00.39\(12\):*:*:*:*:*:*:*
- cpe:2.3:o:wago:pfc200_firmware:03.01.07\(13\):*:*:*:*:*:*:*
- cpe:2.3:o:wago:pfc200_firmware:03.02.02\(14\):*:*:*:*:*:*:*
More vulnerabilities in Wago Pfc200 Firmware
- CVE-2023-1698 — Critical (CVSS 9.8): In multiple products of WAGO a vulnerability allows an unauthenticated, remote attacker to create new users and change…
- CVE-2022-45140 — Critical (CVSS 9.8): The configuration backend allows an unauthenticated user to write arbitrary data with root privileges to the storage,…
- CVE-2022-45138 — Critical (CVSS 9.8): The configuration backend of the web-based management can be used by unauthenticated users, although only authenticated…
- CVE-2019-5082 — Critical (CVSS 9.8): An exploitable heap buffer overflow vulnerability exists in the iocheckd service I/O-Check functionality of WAGO PFC200…
- CVE-2018-5459 — Critical (CVSS 9.8): An Improper Authentication issue was discovered in WAGO PFC200 Series 3S CoDeSys Runtime versions 2.3.X and 2.4.X. An…
- CVE-2019-5161 — Critical (CVSS 9.1): An exploitable remote code execution vulnerability exists in the Cloud Connectivity functionality of WAGO PFC200…