How severe is CVE-2019-5167?

CVE-2019-5167 has a CVSS 3.x base score of 7.8, rated high severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2019-5167 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (67th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2019-5167?

CVE-2019-5167 affects Wago Pfc200 Firmware. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2019-5167?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2019-5167 published?

CVE-2019-5167 was published on 2020-03-11 and last updated on 2026-06-17.

CVE-2019-5167

CVE-2019-5167 is a high-severity vulnerability in Wago Pfc200 Firmware with a CVSS 3.x base score of 7.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-78.

Key facts

Severity: High (CVSS 3.x base score 7.8)
CVSS v2: 7.2
EPSS exploit prediction: 1% (67th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-78
Affected product: Wago Pfc200 Firmware
Published: 2020-03-11
Last modified: 2026-06-17

Description

An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 version 03.02.02(14). At 0x1e3f0 the extracted dns value from the xml file is used as an argument to /etc/config-tools/edit_dns_server %s dns-server-nr=%d dns-server-name=<contents of dns node> using sprintf(). This command is later executed via a call to system(). This is done in a loop and there is no limit to how many dns entries will be parsed from the xml file.

Frequently asked questions

What is CVE-2019-5167?: An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 version 03.02.02(14). At 0x1e3f0 the extracted dns value from the xml file is used as an argument to /etc/config-tools/edit_dns_server %s dns-server-nr=%d dns-server-name=<contents of dns node> using sprintf(). This command is later executed via a call to system(). This is done in a loop and there is no limit to how many dns entries will be parsed from the xml file.
How severe is CVE-2019-5167?: CVE-2019-5167 has a CVSS 3.x base score of 7.8, rated high severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2019-5167 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (67th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2019-5167?: CVE-2019-5167 affects Wago Pfc200 Firmware. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2019-5167?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2019-5167 published?: CVE-2019-5167 was published on 2020-03-11 and last updated on 2026-06-17.

References

https://talosintelligence.com/vulnerability_reports/TALOS-2019-0962

Affected products (1)

cpe:2.3:o:wago:pfc200_firmware:03.02.02\(14\):*:*:*:*:*:*:*

More vulnerabilities in Wago Pfc200 Firmware

CVE-2023-1698 — Critical (CVSS 9.8): In multiple products of WAGO a vulnerability allows an unauthenticated, remote attacker to create new users and change…
CVE-2022-45140 — Critical (CVSS 9.8): The configuration backend allows an unauthenticated user to write arbitrary data with root privileges to the storage,…
CVE-2022-45138 — Critical (CVSS 9.8): The configuration backend of the web-based management can be used by unauthenticated users, although only authenticated…
CVE-2019-5082 — Critical (CVSS 9.8): An exploitable heap buffer overflow vulnerability exists in the iocheckd service I/O-Check functionality of WAGO PFC200…
CVE-2018-5459 — Critical (CVSS 9.8): An Improper Authentication issue was discovered in WAGO PFC200 Series 3S CoDeSys Runtime versions 2.3.X and 2.4.X. An…
CVE-2019-5161 — Critical (CVSS 9.1): An exploitable remote code execution vulnerability exists in the Cloud Connectivity functionality of WAGO PFC200…

All CVEs affecting Wago Pfc200 Firmware →

Other CWE-78 (OS Command Injection) vulnerabilities

CVE-2026-100382 — Critical (CVSS 10.0): Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Wikimedia…
CVE-2026-77521 — Critical (CVSS 10.0): MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.5-lts, assistants with a tool, MCP tool,…
CVE-2026-82004 — Critical (CVSS 10.0): Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS…
CVE-2026-76197 — Critical (CVSS 10.0): Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS…
CVE-2026-76195 — Critical (CVSS 10.0): Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS…
CVE-2026-19188 — Critical (CVSS 10.0): A critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gateway product. The…

Browse all CWE-78 (OS Command Injection) vulnerabilities →