CVE-2019-5178
📋 TL;DR
This is a stack buffer overflow vulnerability in the iocheckd service of WAGO PFC 200 industrial controllers. An attacker can send specially crafted packets to crash the service or potentially execute arbitrary code. This affects organizations using WAGO PFC 200 Firmware version 03.02.02(14) in industrial control systems.
💻 Affected Systems
- WAGO PFC 200
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, disruption of industrial processes, or lateral movement within OT networks.
Likely Case
Service crash causing denial of service to the I/O-Check functionality, potentially disrupting industrial operations.
If Mitigated
Limited impact if network segmentation prevents access to the vulnerable service from untrusted networks.
🎯 Exploit Status
The vulnerability is well-documented with proof-of-concept details available in the Talos report. Exploitation requires sending a specially crafted packet to the iocheckd service.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Later firmware versions (check WAGO advisory)
Vendor Advisory: https://www.wago.com/global/industrial-security/security-advisory
Restart Required: Yes
Instructions:
1. Check WAGO security advisory for specific patched version. 2. Backup configuration. 3. Download updated firmware from WAGO. 4. Apply firmware update following vendor instructions. 5. Reboot device.
🔧 Temporary Workarounds
Network Segmentation
allIsolate WAGO PFC 200 devices from untrusted networks using firewalls or VLANs.
Service Disablement
linuxDisable the iocheckd service if not required for operations.
ssh into device and run: systemctl stop iocheckd
systemctl disable iocheckd
🧯 If You Can't Patch
- Implement strict network access controls to limit connections to the iocheckd service (default port 6626).
- Monitor for crash logs of the iocheckd service and network traffic patterns indicating exploitation attempts.
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface or SSH: cat /etc/version_info | grep FirmwareCheck Version:
cat /etc/version_info | grep FirmwareVerify Fix Applied:
Verify firmware version is updated beyond 03.02.02(14) and iocheckd service is either patched or disabled.📡 Detection & Monitoring
Log Indicators:
- iocheckd service crash logs
- unexpected process termination
Network Indicators:
- Unusual traffic to port 6626
- Packets with long hostname fields (>1024 bytes)
SIEM Query:
source="wago_logs" AND (process="iocheckd" AND event="crash") OR (dest_port=6626 AND packet_size>1100)