CVE-2019-5170

Vulnerability

The iocheckd service's I/O-Check function in WAGO PFC 200 firmware version 03.02.02(14) parses an XML cache file stored at /tmp/iocheckCache.xml. The hostname node value is extracted and used unsanitized in a sprintf() call to build a command string that is later executed via system(). The cache file is globally writable, allowing any local user to write a malicious XML file [1].

Exploitation

An attacker with local access to the device writes a specially crafted XML file to /tmp/iocheckCache.xml containing OS command injection in the hostname field. The vulnerability is triggered by sending a BC_SaveParameter message, which causes the iocheckd service to parse the cache file and execute the injected commands. No additional authentication is required beyond the ability to write to /tmp [1].

Impact

Successful exploitation results in arbitrary OS command execution as the root user, leading to full compromise of the device's confidentiality, integrity, and availability. The attacker gains complete control over the controller [1].

Mitigation

As of the publication date (2020-03-11), no official patch has been disclosed in the available reference. Users should restrict local access to the device, monitor vendor advisories for updates, and consider network segmentation to limit exposure [1].