Uncontrolled resource consumption in WAGO PFC200 Firmware
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-400.
Summary
The WBM web application on firmwares prior to 03.02.02 and 03.01.07 on the WAGO PFC100 and PFC2000, respectively, runs on a lighttpd web server and makes use of the FastCGI module, which is intended to provide high performance for all Internet applications without the penalties of Web server APIs. However, the default configuration of this module appears to limit the number of concurrent php-cgi processes to two, which can be abused to cause a denial of service of the entire web server. This affects WAGO PFC200 Firmware version 03.00.39(12) and version 03.01.07(13), and WAGO PFC100 Firmware version 03.00.39(12) and version 03.02.02(14).
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| WAGO | WAGO PFC200 Firmware | version 03.00.39(12); version 03.01.07(13) | — | No fix listed | CNA |
| WAGO | WAGO PFC100 Firmware | version 03.00.39(12); version 03.02.02(14) | — | No fix listed | CNA |
- WAGO PFC200 Firmware VendorWAGO Affected version 03.00.39(12); version 03.01.07(13) Fixed in — No fix listed CNA
- WAGO PFC100 Firmware VendorWAGO Affected version 03.00.39(12); version 03.02.02(14) Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:wago:pfc200_firmware:03.00.39\(12\):*:*:*:*:*:*:* | 03.00.39(12) | Vulnerable | WAGO |
| cpe:2.3:o:wago:pfc200_firmware:03.01.07\(13\):*:*:*:*:*:*:* | 03.01.07(13) | Vulnerable | WAGO |
| cpe:2.3:h:wago:pfc200:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:pfc100_firmware:03.00.39\(12\):*:*:*:*:*:*:* | 03.00.39(12) | Vulnerable | WAGO |
| cpe:2.3:o:wago:pfc100_firmware:03.01.07\(13\):*:*:*:*:*:*:* | 03.01.07(13) | Vulnerable | WAGO |
| cpe:2.3:h:wago:pfc100:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
- cpe:2.3:o:wago:pfc200_firmware:03.00.39\(12\):*:*:*:*:*:*:* Versions 03.00.39(12) Vulnerable ·WAGO
- cpe:2.3:o:wago:pfc200_firmware:03.01.07\(13\):*:*:*:*:*:*:* Versions 03.01.07(13) Vulnerable ·WAGO
- cpe:2.3:h:wago:pfc200:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:pfc100_firmware:03.00.39\(12\):*:*:*:*:*:*:* Versions 03.00.39(12) Vulnerable ·WAGO
- cpe:2.3:o:wago:pfc100_firmware:03.01.07\(13\):*:*:*:*:*:*:* Versions 03.01.07(13) Vulnerable ·WAGO
- cpe:2.3:h:wago:pfc100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2019-5149
- 2026-10-03 Alias added: GHSA-g23p-pfjq-33rc
References
More WAGO Pfc100 Firmware vulnerabilities
- TI-2023-01594 WAGO: WBM Command Injection in multiple products CVSS 3.1CRITICAL 9.8
- TI-2019-03543 Out-of-bounds write in WAGO PFC200 CVSS 3.1CRITICAL 9.8
- TI-2022-22215 WAGO: Missing Authentication for Critical Function CVSS 3.1CRITICAL 9.8
- TI-2019-08172 Uncontrolled resource consumption in ABB 1SAP120600R0071 PM554-TP-ETH CVSS 3.1HIGH 7.5
- TI-2022-22213 WAGO: Missing Authentication for Critical Function CVSS 3.1CRITICAL 9.8
- TI-2019-03590 An exploitable regular expression without anchors vulnerability exists in the Web-Based… CVSS 3.1HIGH 7.5
Sources
- CVE-2019-5149 · CVE Program
- CVE-2019-5149 · NVD
- FIRST EPSS
- GHSA-g23p-pfjq-33rc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences