https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 12:06:23 +0000 https://cve.radiocsirt.org/vuln/cnvd-2020-16848 cnvd-2020-16848 https://cve.radiocsirt.org/vuln/cnvd-2020-16848 https://cve.radiocsirt.org/vuln/euvd-2026-50014 EUVD-2026-50014 https://cve.radiocsirt.org/vuln/euvd-2026-50014 https://cve.radiocsirt.org/vuln/fkie_cve-2019-5170 <p>An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 Firmware version 03.02.02(14). A specially crafted XML cache file written to a specific location on the device can be used to inject OS commands. An attacker can send a specially crafted packet to trigger the parsing of this cache file.At 0x1e87c the extracted hostname value from the xml file is used as an argument to /etc/config-tools/change_hostname hostname=&lt;contents of hostname node&gt; using sprintf(). This command is later executed via a call to system().</p> <p>An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 Firmware version 03.02.02(14). A specially crafted XML cache file written to a specific location on the device can be used to inject OS commands. An attacker can send a specially crafted packet to trigger the parsing of this cache file.At 0x1e87c the extracted hostname value from the xml file is used as an argument to /etc/config-tools/change_hostname hostname=&lt;contents of hostname node&gt; using sprintf(). This command is later executed via a call to system().</p> https://cve.radiocsirt.org/vuln/fkie_cve-2019-5170 https://cve.radiocsirt.org/vuln/ghsa-59q2-93ch-m6p9 <p>An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 Firmware version 03.02.02(14). A specially crafted XML cache file written to a specific location on the device can be used to inject OS commands. An attacker can send a specially crafted packet to trigger the parsing of this cache file.At 0x1e87c the extracted hostname value from the xml file is used as an argument to /etc/config-tools/change_hostname hostname=&lt;contents of hostname node&gt; using sprintf(). This command is later executed via a call to system().</p> <p>An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 Firmware version 03.02.02(14). A specially crafted XML cache file written to a specific location on the device can be used to inject OS commands. An attacker can send a specially crafted packet to trigger the parsing of this cache file.At 0x1e87c the extracted hostname value from the xml file is used as an argument to /etc/config-tools/change_hostname hostname=&lt;contents of hostname node&gt; using sprintf(). This command is later executed via a call to system().</p> https://cve.radiocsirt.org/vuln/ghsa-59q2-93ch-m6p9 https://cve.radiocsirt.org/vuln/gsd-2019-5170 gsd-2019-5170 https://cve.radiocsirt.org/vuln/gsd-2019-5170 https://cve.radiocsirt.org/vuln/vde-2020-011 <p>An attacker needs an authorized login on the device in order to exploit the herein mentioned vulnerabilities.</p> <p>The reported vulnerabilities allow a local attacker with valid login credentials who is able to create files on the device to change the devices settings, e.g. default gateway address, time server etc. and potentially execute code.</p> <p>An attacker needs an authorized login on the device in order to exploit the herein mentioned vulnerabilities.</p> <p>The reported vulnerabilities allow a local attacker with valid login credentials who is able to create files on the device to change the devices settings, e.g. default gateway address, time server etc. and potentially execute code.</p> https://cve.radiocsirt.org/vuln/vde-2020-011