CVE Feed

    Dashboard / CVE / CVE-2018-5459

    CVE-2018-5459

    An Improper Authentication issue was discovered in WAGO PFC200 Series 3S CoDeSys Runtime versions 2.3.X and 2.4.X. An attacker can execute different unauthenticated remote operations because of the CoDeSys Runtime application, which is available via network by default on Port 2455. An attacker could execute some unauthenticated commands such as reading, writing, or deleting arbitrary files, or manipulate the PLC application during runtime by sending specially-crafted TCP packets to Port 2455.

    Published:Feb 13, 2018
    Last Modified:Nov 21, 2024
    EPS:Feb 13, 2018
    EPSS Score:0.00907
    CVSS Score:9.8

    Affected Products

    Vendor
    Wago
    Product
    750-8202
    Vendor
    Wago
    Product
    750-8202\/025-000
    Vendor
    Wago
    Product
    750-8202\/025-001
    Vendor
    Wago
    Product
    750-8202\/025-002
    Vendor
    Wago
    Product
    750-8202\/040-001
    Vendor
    Wago
    Product
    750-8203
    Vendor
    Wago
    Product
    750-8203\/025-000
    Vendor
    Wago
    Product
    750-8204
    Vendor
    Wago
    Product
    750-8204\/025-000
    Vendor
    Wago
    Product
    750-8206
    Vendor
    Wago
    Product
    750-8206\/025-000
    Vendor
    Wago
    Product
    750-8206\/025-001
    Vendor
    Wago
    Product
    750-8207
    Vendor
    Wago
    Product
    750-8207\/025-000
    Vendor
    Wago
    Product
    750-8207\/025-001
    Vendor
    Wago
    Product
    750-8208
    Vendor
    Wago
    Product
    750-8208\/025-000
    Vendor
    Wago
    Product
    Pfc200
    Vendor
    Wago
    Product
    Pfc200 Firmware

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-287 Improper Authentication

    Related CVEs

    CVE-2023-1620 (CVSS 4.9) — Multiple WAGO devices in multiple versions may allow an authenticated remote attacker with high privileges to …
    CVE-2023-1619 (CVSS 4.9) — Multiple WAGO devices in multiple versions may allow an authenticated remote attacker with high privileges to …
    CVE-2020-12069 (CVSS 7.8) — In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime …
    CVE-2021-34569 (CVSS 9.8) — In WAGO I/O-Check Service in multiple products an attacker can send a specially crafted packet containing OS c…
    CVE-2021-34568 (CVSS 7.5) — In WAGO I/O-Check Service in multiple products an unauthenticated remote attacker can send a specially crafted…
    CVE-2021-34567 (CVSS 8.2) — In WAGO I/O-Check Service in multiple products an unauthenticated remote attacker can send a specially crafted…
    CVE-2021-34566 (CVSS 9.1) — In WAGO I/O-Check Service in multiple products an unauthenticated remote attacker can send a specially crafted…
    CVE-2022-22511 (CVSS 5.4) — Various configuration pages of the device are vulnerable to reflected XSS (Cross-Site Scripting) attacks. An a…
    CVE-2021-34596 (CVSS 6.5) — A crafted request may cause a read access to an uninitialized pointer in CODESYS V2 Runtime Toolkit 32 Bit ful…
    CVE-2021-34595 (CVSS 8.1) — A crafted request with invalid offsets may cause an out-of-bounds read or write access in CODESYS V2 Runtime T…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High