CVE-2018-5459
Critical
Description
An Improper Authentication issue was discovered in WAGO PFC200 Series 3S CoDeSys Runtime versions 2.3.X and 2.4.X. An attacker can execute different unauthenticated remote operations because of the CoDeSys Runtime application, which is available via network by default on Port 2455. An attacker could execute some unauthenticated commands such as reading, writing, or deleting arbitrary files, or manipulate the PLC application during runtime by sending specially-crafted TCP packets to Port 2455.
SeverityCritical
CVSS9.8
Exploit probability—
ProductWago Pfc200 Firmware
PublishedFeb 13, 2018
First seenFeb 13, 2018
Weakness typeCWE-287Improper authentication
How to fix
Update
- wago pfc200_firmware02.07.07\(10\) or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wago pfc200_firmware | v < 02.07.07\(10\) | 02.07.07\(10\) |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.