Lucene search

TalosCVE-2019-5135

HistoryMar 11, 2020 - 10:27 p.m.

CVE-2019-5135

2020-03-1122:27:40

CWE-327

talos

web.nvd.nist.gov

cve-2019-5135

vulnerability

authentication

wago

pfc100

pfc200

controllers

web application

php crypt() function

user credentials

disclosure

firmware

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.9

Confidence

High

EPSS

0.001

Percentile

47.4%

JSON

An exploitable timing discrepancy vulnerability exists in the authentication functionality of the Web-Based Management (WBM) web application on WAGO PFC100/200 controllers. The WBM application makes use of the PHP crypt() function which can be exploited to disclose hashed user credentials. This affects WAGO PFC200 Firmware version 03.00.39(12) and version 03.01.07(13), and WAGO PFC100 Firmware version 03.00.39(12).

Affected configurations

Nvd

Vulners

Node

wagopfc200_firmwareMatch03.00.39\(12\)

wagopfc200_firmwareMatch03.01.07\(13\)

AND

wagopfc200Match-

Node

wagopfc100_firmwareMatch03.00.39\(12\)

AND

wagopfc100Match-

VendorProductVersionCPE
wagopfc200_firmware03.00.39(12)cpe:2.3:o:wago:pfc200_firmware:03.00.39\(12\):*:*:*:*:*:*:*
wagopfc200_firmware03.01.07(13)cpe:2.3:o:wago:pfc200_firmware:03.01.07\(13\):*:*:*:*:*:*:*
wagopfc200-cpe:2.3:h:wago:pfc200:-:*:*:*:*:*:*:*
wagopfc100_firmware03.00.39(12)cpe:2.3:o:wago:pfc100_firmware:03.00.39\(12\):*:*:*:*:*:*:*
wagopfc100-cpe:2.3:h:wago:pfc100:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
wago	pfc200_firmware	03.00.39(12)	cpe:2.3:o:wago:pfc200_firmware:03.00.39\(12\):::::::*
wago	pfc200_firmware	03.01.07(13)	cpe:2.3:o:wago:pfc200_firmware:03.01.07\(13\):::::::*
wago	pfc200	-	cpe:2.3:h:wago:pfc200:-:::::::*
wago	pfc100_firmware	03.00.39(12)	cpe:2.3:o:wago:pfc100_firmware:03.00.39\(12\):::::::*
wago	pfc100	-	cpe:2.3:h:wago:pfc100:-:::::::*

CNA Affected

[
  {
    "product": "WAGO PFC200 Firmware",
    "vendor": "Wago",
    "versions": [
      {
        "status": "affected",
        "version": "version 03.00.39(12)"
      },
      {
        "status": "affected",
        "version": "version 03.01.07(13)"
      }
    ]
  },
  {
    "product": "WAGO PFC100 Firmware",
    "vendor": "Wago",
    "versions": [
      {
        "status": "affected",
        "version": "version 03.00.39(12)"
      }
    ]
  }
]

References

talosintelligence.com/vulnerability_reports/TALOS-2019-0924

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.9

Confidence

High

EPSS

0.001

Percentile

47.4%

JSON

Related for CVE-2019-5135