CVE-2019-5155

PoC —

CVSS 3.1

7.2 high

EPSS

5%p91

Published

Mar 11, 2020 (Mar 11, 2020)

Modified

Jun 17, 2026

Description

An exploitable command injection vulnerability exists in the cloud connectivity feature of WAGO PFC200. An attacker can inject operating system commands into any of the parameter values contained in the firmware update command. This affects WAGO PFC200 Firmware version 03.02.02(14), version 03.01.07(13), and version 03.00.39(12)

Vendors: wago
Products: pfc200 firmware
Weakness: CWE-78
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (4.6%)

In the news2 stories

Vulnerability Spotlight: A deep dive into WAGO’s cloud connectivity and the vulnerabilities that arise

Cisco TalosOct 21, 19:30 UTC · Oct 21, 2020Vulnerability CVE-2019-5161 CVE-2019-5155 CVE-2019-5157+1 CVEs

Vulnerability Spotlight: WAGO products contain remote code execution, other vulnerabilities

Cisco TalosMar 9, 14:47 UTC · Mar 9, 2020Vulnerability CVE-2019-5107 CVE-2019-5134 CVE-2019-5135+9 CVEs