Vulnerability Spotlight: A deep dive into WAGO’s cloud connectivity and the vulnerabilities that arise

Summary: Cisco Talos discovered 41 vulnerabilities in WAGO's PFC200 and PFC100 programmable automation controllers, including OS command injection in the dataagent cloud connectivity client's firmware update handling (TALOS-2019-0948 through TALOS-2019-0950, CVE-2019-5155 through CVE-2019-5157) and improper host validation (TALOS-2019-0953/CVE-2019-5160) that lets an attacker point the device at an attacker-controlled Azure IoT Hub instance. Talos combined these with WBM credential-leak flaws (TALOS-2019-0923/CVE-2019-5134 and TALOS-2019-0924/CVE-2019-5135) and 18 iocheckd cache-file parsing vulnerabilities to build two attack chains that achieve root code execution on firmware version 13 of the PFC200; WAGO has released a firmware update.
What you should know: The attack originates from a trusted cloud provider while the cloud instance itself is attacker-controlled, so the device is compromised through the very channel WAGO built for remote telemetry and firmware updates. These controllers run in automotive, rail, power engineering, manufacturing and building management environments, and the iocheckd service executes the injected commands as root.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2019-5155 CVE-2019-5157 CVE-2019-5161
Related: Vulnerability Spotlight: WAGO products contain remote code execution, other vulnerabilities Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026