CVE-2019-5180
📋 TL;DR
This is a stack buffer overflow vulnerability in the iocheckd service of WAGO PFC 200 industrial controllers. An attacker can send specially crafted packets to trigger the overflow, potentially leading to service crashes or remote code execution. Organizations using WAGO PFC 200 Firmware version 03.02.02(14) are affected.
💻 Affected Systems
- WAGO PFC 200
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with root privileges, allowing complete compromise of the industrial controller and potential lateral movement to other systems.
Likely Case
Service crash causing denial of service to the industrial controller, disrupting industrial processes and operations.
If Mitigated
Limited impact if proper network segmentation and access controls prevent attackers from reaching the vulnerable service.
🎯 Exploit Status
The vulnerability requires sending a specially crafted packet to the iocheckd service, which is well-documented in the Talos report.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check WAGO security advisories for updated firmware versions
Vendor Advisory: https://www.wago.com/global/industrial-security/security-advisories
Restart Required: Yes
Instructions:
1. Check WAGO security advisories for patch availability. 2. Download updated firmware from WAGO support portal. 3. Apply firmware update following WAGO documentation. 4. Restart the controller to activate the patch.
🔧 Temporary Workarounds
Network Segmentation
allIsolate WAGO PFC 200 controllers in separate network segments with strict firewall rules.
Service Disablement
linuxDisable the iocheckd service if not required for operations (may impact functionality).
systemctl stop iocheckd
systemctl disable iocheckd
🧯 If You Can't Patch
- Implement strict network access controls to limit connections to the iocheckd service (port 6626 by default).
- Monitor network traffic for anomalous packets targeting the iocheckd service and implement intrusion detection rules.
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface or SSH: cat /etc/version_info | grep '03.02.02(14)'Check Version:
cat /etc/version_infoVerify Fix Applied:
Verify firmware version is updated beyond 03.02.02(14) and test that iocheckd service no longer crashes with malformed packets.📡 Detection & Monitoring
Log Indicators:
- iocheckd service crash logs in /var/log/messages
- Segmentation fault errors related to iocheckd
Network Indicators:
- Unusual traffic to port 6626 (default iocheckd port)
- Packets with long ip parameter values (>1024 bytes)
SIEM Query:
source="*messages*" AND "iocheckd" AND ("segmentation fault" OR "crash")