CVE-2019-5184

Vulnerability

A double-free vulnerability exists in the iocheckd service's I/O-Check functionality of WAGO PFC200 controllers running firmware version 03.02.02(14) [1]. The service parses a file-backed cache stored at /tmp/iocheckCache.xml, which is globally writable. During parsing, the heap buffer used to store values for each gateway XML element is freed once per element; a specially crafted cache file containing multiple gateway elements causes the same heap pointer to be freed multiple times, resulting in a double-free condition [1].

Exploitation

An attacker must write a crafted XML cache file to /tmp/iocheckCache.xml, which is globally writable, and then trigger the iocheckd service to parse that file by sending a specially crafted packet [1]. This requires local access or the ability to write to the device's filesystem; low privileges are sufficient to write the cache file. The attacker does not need authentication for the subsequent packet trigger, but the attack complexity is high due to the need to craft the payload and time the write appropriately [1].

Impact

Successful exploitation causes the iocheckd service to crash, leading to a denial of service for various iocheckd messages (e.g., BC_FactoryRestore) that will respond with errors instead of performing their intended functions [1]. Depending on the memory allocator used, the double-free condition may be leveraged for arbitrary code execution, potentially compromising the entire controller [1].

Mitigation

WAGO has not released a patched firmware version in the available references [1]. Users should monitor the vendor advisory for updates. As a workaround, restrict write access to /tmp/iocheckCache.xml or use filesystem permissions to prevent unauthorized modification of the cache file [1]. This vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities catalog.