CVE-2019-12549

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

WAGO 852-303 before FW06, 852-1305 before FW06, and 852-1505 before FW03 devices contain hardcoded private keys for the SSH daemon. The fingerprint of the SSH host key from the corresponding SSH daemon matches the embedded private key.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-798

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://cert.vde.com/en-us/advisories/vde-2019-013Third Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-19-164-02Third Party Advisory, US Government Resource
https://www.wago.com/us/Vendor Advisory
https://cert.vde.com/en-us/advisories/vde-2019-013Third Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-19-164-02Third Party Advisory, US Government Resource
https://www.wago.com/us/Vendor Advisory

Timeline

Published: Jun 17, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-12557.5A denial of service vulnerability exists when Microsoft Defender improperly handles files, aka 'Microsoft Defender Denial of Service Vulnera CVE-2019-125509.8WAGO 852-303 before FW06, 852-1305 before FW06, and 852-1505 before FW03 devices contain hardcoded users and passwords that can be used to l CVE-2019-125515.5In SweetScape 010 Editor 9.0.1, improper validation of arguments in the internal implementation of the Memcpy function (provided by the scri CVE-2019-125525.5In SweetScape 010 Editor 9.0.1, an integer overflow during the initialization of variables could allow an attacker to cause a denial of serv CVE-2019-125539.8In SweetScape 010 Editor 9.0.1, improper validation of arguments in the internal implementation of the StrCat function (provided by the scri CVE-2019-125547.5In SweetScape 010 Editor 9.0.1, improper validation of arguments in the internal implementation of the WSubStr function (provided by the scr CVE-2019-125557.5In SweetScape 010 Editor 9.0.1, improper validation of arguments in the internal implementation of the SubStr function (provided by the scri CVE-2019-12567.8An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k CVE-2019-125626.1Stored Cross-Site Scripting in DotNetNuke (DNN) Version before 9.4.0 allows remote attackers to store and embed the malicious script into th CVE-2019-125649.8In DouCo DouPHP v1.5 Release 20190516, remote attackers can view the database backup file via a brute-force guessing approach for data/backu CVE-2019-125665.4The WP Statistics plugin through 12.6.5 for Wordpress has stored XSS in includes/class-wp-statistics-pages.php. This is related to an accoun CVE-2019-125679.8Stack-based overflow vulnerability in the logMess function in Open TFTP Server MT 1.65 and earlier allows remote attackers to perform a deni