CVE-2019-5135

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An exploitable timing discrepancy vulnerability exists in the authentication functionality of the Web-Based Management (WBM) web application on WAGO PFC100/200 controllers. The WBM application makes use of the PHP crypt() function which can be exploited to disclose hashed user credentials. This affects WAGO PFC200 Firmware version 03.00.39(12) and version 03.01.07(13), and WAGO PFC100 Firmware version 03.00.39(12).

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-327

Affected software

Vendor	Product	Versions
Wago	WAGO PFC200 Firmware	version 03.00.39(12); version 03.01.07(13)
Wago	WAGO PFC100 Firmware	version 03.00.39(12)

References

https://talosintelligence.com/vulnerability_reports/TALOS-2019-0924Exploit, Mitigation, Third Party Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2019-0924Exploit, Mitigation, Third Party Advisory

Timeline

Published: Mar 11, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-51368.8An exploitable privilege escalation vulnerability exists in the iw_console functionality of the Moxa AWK-3131A firmware version 1.13. A spec CVE-2019-51377.5The usage of hard-coded cryptographic keys within the ServiceAgent binary allows for the decryption of captured traffic across the network f CVE-2019-51389.9An exploitable command injection vulnerability exists in encrypted diagnostic script functionality of the Moxa AWK-3131A firmware version 1.CVE-2019-51397.1An exploitable use of hard-coded credentials vulnerability exists in multiple iw_* utilities of the Moxa AWK-3131A firmware version 1.13. Th CVE-2019-51408.8An exploitable command injection vulnerability exists in the iwwebs functionality of the Moxa AWK-3131A firmware version 1.13. A specially c CVE-2019-51418.8An exploitable command injection vulnerability exists in the iw_webs functionality of the Moxa AWK-3131A firmware version 1.13. A specially CVE-2019-51427.2An exploitable command injection vulnerability exists in the hostname functionality of the Moxa AWK-3131A firmware version 1.13. A specially CVE-2019-51438.8An exploitable format string vulnerability exists in the iw_console conio_writestr functionality of the Moxa AWK-3131A firmware version 1.13 CVE-2019-51448.8An exploitable heap underflow vulnerability exists in the derive_taps_and_gains function in kdu_v7ar.dll of Kakadu Software SDK 7.10.2. A sp CVE-2019-51458.8An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit PDF Reader, version 9.7.0.29435. A specially crafted PD CVE-2019-51468.6An exploitable out-of-bounds read vulnerability exists in AMD ATIDXX64.DLL driver, version 26.20.13025.10004. A specially crafted pixel shad CVE-2019-51478.6An exploitable out-of-bounds read vulnerability exists in AMD ATIDXX64.DLL driver, version 26.20.13003.1007. A specially crafted pixel shade