https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 16:47:21 +0000 https://cve.radiocsirt.org/vuln/cve-2019-5185 <p><strong>Affected:</strong> Wago</p> <p>An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service &#34;I/O-Check&#34; functionality of WAGO PFC 200. An attacker can send a specially crafted packet to trigger the parsing of this cache file. At 0x1ea28 the extracted state value from the xml file is used as an argument to /etc/config-tools/config_interfaces interface=X1 state=&lt;contents of state node&gt; using sprintf(). The destination buffer sp+0x40 is overflowed with the call to sprintf() for any state values that are greater than 512-len(&#34;/etc/config-tools/config_interfaces interface=X1 state=&#34;) in length. Later, at 0x1ea08 strcpy() is used to copy the contents of the stack buffer that was overflowed sp+0x40 into sp+0x440. The buffer sp+0x440 is immediately adjacent to sp+0x40 on the stack. Therefore, there is no NULL termination on the buffer sp+0x40 since it overflowed into sp+0x440. The strcpy() will result in invalid memory access. An state value of length 0x3c9 will cause the service to crash.</p> <p><strong>Affected:</strong> Wago</p> <p>An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service &#34;I/O-Check&#34; functionality of WAGO PFC 200. An attacker can send a specially crafted packet to trigger the parsing of this cache file. At 0x1ea28 the extracted state value from the xml file is used as an argument to /etc/config-tools/config_interfaces interface=X1 state=&lt;contents of state node&gt; using sprintf(). The destination buffer sp+0x40 is overflowed with the call to sprintf() for any state values that are greater than 512-len(&#34;/etc/config-tools/config_interfaces interface=X1 state=&#34;) in length. Later, at 0x1ea08 strcpy() is used to copy the contents of the stack buffer that was overflowed sp+0x40 into sp+0x440. The buffer sp+0x440 is immediately adjacent to sp+0x40 on the stack. Therefore, there is no NULL termination on the buffer sp+0x40 since it overflowed into sp+0x440. The strcpy() will result in invalid memory access. An state value of length 0x3c9 will cause the service to crash.</p> https://cve.radiocsirt.org/vuln/cve-2019-5185