CVE-2020-12522 Command injection in Series PFC 100 (750-81xx/xxx-xxx)

What is CVE-2020-12522?

CVE-2020-12522 is a critical command injection vulnerability in WAGO Series PFC 100 (750-81xx/xxx-xxx), published on 17 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The reported vulnerability allows an attacker who has network access to the device to execute code with specially crafted packets in WAGO Series PFC 100 (750-81xx/xxx-xxx), Series PFC 200 (750-82xx/xxx-xxx), Series Wago Touch Panel 600 Standard Line (762-4xxx), Series Wago Touch Panel 600 Advanced Line (762-5xxx), Series Wago Touch Panel 600 Marine Line (762-6xxx) with firmware versions <=FW10.

Weakness: CWE-78

Which versions are affected by CVE-2020-12522?

It affects 5 products.

Products include Wago Pfc 100 Firmware, Wago Pfc 200 Firmware, Wago Touch Panel 600 Advanced Firmware, Wago Touch Panel 600 Marine Firmware, Wago Touch Panel 600 Standard Firmware.

How do I fix CVE-2020-12522?

No fix has been published for CVE-2020-12522 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2020-12522 being exploited?

There is no known exploitation of CVE-2020-12522 in the wild and no public exploit code.

Other vulnerabilities in WAGO Series PFC 100 (750-81xx/xxx-xxx)

• CVE-2019-5074 Memory corruption in WAGO PFC100 Critical 9.8
• CVE-2019-5075 Memory corruption in WAGO PFC100 Critical 9.8
• CVE-2019-5079 Memory corruption in WAGO PFC100 Critical 9.8
• CVE-2019-5081 Memory corruption in WAGO PFC100 Critical 9.8
• CVE-2019-5077 Denial of service in WAGO PFC100 Critical 9.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-qrrv-9vc8-gf2w.