---
cve: "CVE-2019-5169"
severity: "LOW"
cvss: 3.1
epss: "1.4%"
vendor: "WAGO"
kev: false
exploited: false
published: "2020-03-12 00:15:17"
tags: [cve, security, low]
source: tsecurity.de CVE-Dossier
exported: "2026-09-21T01:33:42+02:00"
---

# CVE-2019-5169

> 3.1 LOW

## Beschreibung

An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 Firmware version 03.02.02(14). A specially crafted XML cache file written to a specific location on the device can be used to inject OS commands. An attacker can send a specially crafted packet to trigger the parsing of this cache file. At 0x1e900 the extracted gateway value from the xml file is used as an argument to /etc/config-tools/config_default_gateway number=0 state=enabled value= using sprintf(). This command is later executed via a call to system().

## Referenzen

- <https://talosintelligence.com/vulnerability_reports/TALOS-2019-0962>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2019-5169) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_