Broken or risky cryptographic algorithm in WAGO PFC200 Firmware
Priority LOW 26CWE-327Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-327.
Summary
An exploitable timing discrepancy vulnerability exists in the authentication functionality of the Web-Based Management (WBM) web application on WAGO PFC100/200 controllers. The WBM application makes use of the PHP crypt() function which can be exploited to disclose hashed user credentials. This affects WAGO PFC200 Firmware version 03.00.39(12) and version 03.01.07(13), and WAGO PFC100 Firmware version 03.00.39(12).
Why it matters now
EPSS 0.01047 64th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| WAGO | WAGO PFC200 Firmware | version 03.00.39(12); version 03.01.07(13) | — | No fix listed | CNA |
| WAGO | WAGO PFC100 Firmware | version 03.00.39(12) | — | No fix listed | CNA |
- WAGO PFC200 Firmware VendorWAGO Affected version 03.00.39(12); version 03.01.07(13) Fixed in — No fix listed CNA
- WAGO PFC100 Firmware VendorWAGO Affected version 03.00.39(12) Fixed in — No fix listed CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:wago:pfc200_firmware:03.00.39\(12\):*:*:*:*:*:*:* | 03.00.39(12) | Vulnerable | WAGO |
| cpe:2.3:o:wago:pfc200_firmware:03.01.07\(13\):*:*:*:*:*:*:* | 03.01.07(13) | Vulnerable | WAGO |
| cpe:2.3:h:wago:pfc200:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:pfc100_firmware:03.00.39\(12\):*:*:*:*:*:*:* | 03.00.39(12) | Vulnerable | WAGO |
| cpe:2.3:h:wago:pfc100:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
- cpe:2.3:o:wago:pfc200_firmware:03.00.39\(12\):*:*:*:*:*:*:* Versions 03.00.39(12) Vulnerable ·WAGO
- cpe:2.3:o:wago:pfc200_firmware:03.01.07\(13\):*:*:*:*:*:*:* Versions 03.01.07(13) Vulnerable ·WAGO
- cpe:2.3:h:wago:pfc200:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:pfc100_firmware:03.00.39\(12\):*:*:*:*:*:*:* Versions 03.00.39(12) Vulnerable ·WAGO
- cpe:2.3:h:wago:pfc100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2019-5135
- 2026-10-03 Alias added: GHSA-pgq5-f878-vwpf
References
More WAGO Pfc100 Firmware vulnerabilities
- TI-2023-01594 WAGO: WBM Command Injection in multiple products CVSS 3.1CRITICAL 9.8
- TI-2019-03543 Out-of-bounds write in WAGO PFC200 CVSS 3.1CRITICAL 9.8
- TI-2022-22215 WAGO: Missing Authentication for Critical Function CVSS 3.1CRITICAL 9.8
- TI-2019-08172 Uncontrolled resource consumption in ABB 1SAP120600R0071 PM554-TP-ETH CVSS 3.1HIGH 7.5
- TI-2022-22213 WAGO: Missing Authentication for Critical Function CVSS 3.1CRITICAL 9.8
- TI-2019-03590 An exploitable regular expression without anchors vulnerability exists in the Web-Based… CVSS 3.1HIGH 7.5
Sources
- CVE-2019-5135 · CVE Program
- CVE-2019-5135 · NVD
- FIRST EPSS
- GHSA-pgq5-f878-vwpf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences