Read the docs
TI-2018-03970 Aliases CVE-2018-5459GHSA-qff4-8m6q-cpvp

Improper authentication in WAGO PFC200 Series

Priority MEDIUM 47CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-287.

Summary

An Improper Authentication issue was discovered in WAGO PFC200 Series 3S CoDeSys Runtime versions 2.3.X and 2.4.X. An attacker can execute different unauthenticated remote operations because of the CoDeSys Runtime application, which is available via network by default on Port 2455. An attacker could execute some unauthenticated commands such as reading, writing, or deleting arbitrary files, or manipulate the PLC application during runtime by sending specially-crafted TCP packets to Port 2455.

Why it matters now

EPSS 0.02676 85th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—WAGO PFC200 SeriesWAGO PFC200 Series—No fix listedCNA
  • WAGO PFC200 Series Vendor— Affected WAGO PFC200 Series Fixed in — No fix listed CNA

CPE configurations NVD · 19

CPEVersionsRoleVendor
cpe:2.3:o:wago:pfc200_firmware:*:*:*:*:*:*:*:*before 02.07.07\(10\)VulnerableWAGO
cpe:2.3:h:wago:750-8202:-:*:*:*:*:*:*:*not specified by NVDRunning onWAGO
cpe:2.3:h:wago:750-8202\/025-000:-:*:*:*:*:*:*:*not specified by NVDRunning onWAGO
cpe:2.3:h:wago:750-8202\/025-001:-:*:*:*:*:*:*:*not specified by NVDRunning onWAGO
cpe:2.3:h:wago:750-8202\/025-002:-:*:*:*:*:*:*:*not specified by NVDRunning onWAGO
cpe:2.3:h:wago:750-8202\/040-001:-:*:*:*:*:*:*:*not specified by NVDRunning onWAGO
cpe:2.3:h:wago:750-8203:-:*:*:*:*:*:*:*not specified by NVDRunning onWAGO
cpe:2.3:h:wago:750-8203\/025-000:-:*:*:*:*:*:*:*not specified by NVDRunning onWAGO
cpe:2.3:h:wago:750-8204:-:*:*:*:*:*:*:*not specified by NVDRunning onWAGO
cpe:2.3:h:wago:750-8204\/025-000:-:*:*:*:*:*:*:*not specified by NVDRunning onWAGO
  • cpe:2.3:o:wago:pfc200_firmware:*:*:*:*:*:*:*:* Versions before 02.07.07\(10\) Vulnerable ·WAGO
  • cpe:2.3:h:wago:750-8202:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
  • cpe:2.3:h:wago:750-8202\/025-000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
  • cpe:2.3:h:wago:750-8202\/025-001:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
  • cpe:2.3:h:wago:750-8202\/025-002:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
  • cpe:2.3:h:wago:750-8202\/040-001:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
  • cpe:2.3:h:wago:750-8203:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
  • cpe:2.3:h:wago:750-8203\/025-000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
  • cpe:2.3:h:wago:750-8204:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
  • cpe:2.3:h:wago:750-8204\/025-000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
Show 9 more CPE
CPEVersionsRoleVendor
cpe:2.3:h:wago:750-8206:-:*:*:*:*:*:*:*not specified by NVDRunning onWAGO
cpe:2.3:h:wago:750-8206\/025-000:-:*:*:*:*:*:*:*not specified by NVDRunning onWAGO
cpe:2.3:h:wago:750-8206\/025-001:-:*:*:*:*:*:*:*not specified by NVDRunning onWAGO
cpe:2.3:h:wago:750-8207:-:*:*:*:*:*:*:*not specified by NVDRunning onWAGO
cpe:2.3:h:wago:750-8207\/025-000:-:*:*:*:*:*:*:*not specified by NVDRunning onWAGO
cpe:2.3:h:wago:750-8207\/025-001:-:*:*:*:*:*:*:*not specified by NVDRunning onWAGO
cpe:2.3:h:wago:750-8208:-:*:*:*:*:*:*:*not specified by NVDRunning onWAGO
cpe:2.3:h:wago:750-8208\/025-000:-:*:*:*:*:*:*:*not specified by NVDRunning onWAGO
cpe:2.3:h:wago:pfc200:-:*:*:*:*:*:*:*not specified by NVDRunning onWAGO
  • cpe:2.3:h:wago:750-8206:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
  • cpe:2.3:h:wago:750-8206\/025-000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
  • cpe:2.3:h:wago:750-8206\/025-001:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
  • cpe:2.3:h:wago:750-8207:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
  • cpe:2.3:h:wago:750-8207\/025-000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
  • cpe:2.3:h:wago:750-8207\/025-001:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
  • cpe:2.3:h:wago:750-8208:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
  • cpe:2.3:h:wago:750-8208\/025-000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
  • cpe:2.3:h:wago:pfc200:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-5459
  2. 2026-10-03 Alias added: GHSA-qff4-8m6q-cpvp

References

Advisory 1

  • TI-2023-01594 WAGO: WBM Command Injection in multiple products CVSS 3.1CRITICAL 9.8
  • TI-2019-03543 Out-of-bounds write in WAGO PFC200 CVSS 3.1CRITICAL 9.8
  • TI-2022-22215 WAGO: Missing Authentication for Critical Function CVSS 3.1CRITICAL 9.8
  • TI-2019-03617 Insufficient verification of data authenticity in WAGO PFC200 Firmware CVSS 3.1CRITICAL 9.1
  • TI-2019-03616 An exploitable improper host validation vulnerability exists in the Cloud Connectivity… CVSS 3.1CRITICAL 9.1
  • TI-2022-22213 WAGO: Missing Authentication for Critical Function CVSS 3.1CRITICAL 9.8
See all 39 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences