CVE-2019-5167

Vulnerability

The iocheckd service in WAGO PFC 200 firmware version 03.02.02(14) contains a command injection vulnerability in the "I/O-Check" function. The service parses a cache file at /tmp/iocheckCache.xml, which is globally writable. During parsing, the value of the dns node is extracted and used unsanitized in a sprintf() call to construct a command string that is subsequently executed via system(). There is no limit on the number of DNS entries processed, allowing multiple injections. [1]

Exploitation

An attacker with local access to the device can write a malicious XML file to /tmp/iocheckCache.xml. By sending a BC_SaveParameter message, the iocheckd service is triggered to parse the file. The crafted dns node value contains OS command injection payloads, which are executed with root privileges. No authentication beyond file write access is required. [1]

Impact

Successful exploitation allows an attacker to execute arbitrary OS commands as the root user, resulting in full compromise of the device. This includes complete loss of confidentiality, integrity, and availability (CVSS 8.8). The attacker escalates from a low-privileged user to root. [1]

Mitigation

The available reference does not specify a fixed firmware version. Users should restrict write access to /tmp and monitor for firmware updates from WAGO. If no update is available, consider network segmentation and limiting local access to trusted users only. [1]