CVE-2020-12522

Command Injection Vulnerability in I/O-Check Service of WAGO PFC100, PFC200 and Touch Panel 600 Series with firmware versions <=FW10

State: Published
Severity: 10.0 Critical
Published: Dec 17, 2020
Updated: Sep 16, 2024
Reserved: Apr 30, 2020

Read the record on cve.org

Description

The reported vulnerability allows an attacker who has network access to the device to execute code with specially crafted packets in WAGO Series PFC 100 (750-81xx/xxx-xxx), Series PFC 200 (750-82xx/xxx-xxx), Series Wago Touch Panel 600 Standard Line (762-4xxx), Series Wago Touch Panel 600 Advanced Line (762-5xxx), Series Wago Touch Panel 600 Marine Line (762-6xxx) with firmware versions <=FW10.

Scores

CVSS	Score	Vector	Source
3.1	10.0 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	CERTVDE

Weaknesses

CWE-78 OS Command Injection

Affected Products

Product	Versions
Series PFC 100 (750-81xx/xxx-xxx)WAGO	FW1 through FW10Affected
Series PFC 200 (750-82xx/xxx-xxx)WAGO	FW1 through FW10Affected
Series Wago Touch Panel 600 Standard Line (762-4xxx)WAGO	FW1 through FW10Affected
Series Wago Touch Panel 600 Advanced Line (762-5xxx)WAGO	FW1 through FW10Affected
Series Wago Touch Panel 600 Marine Line (762-6xxx)WAGO	FW1 through FW10Affected

References

https://cert.vde.com/en-us/advisories/vde-2020-045

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.