Vulnerability Spotlight: WAGO products contain remote code execution, other vulnerabilities

Summary: Cisco Talos discovered multiple vulnerabilities in WAGO's e!COCKPIT automation software and its PFC100 and PFC200 controllers, including a hard-coded encryption key in e!Cockpit 1.5.1.1 that lets an attacker with access to communications between e!Cockpit and CoDeSyS Gateway recover any logging-in user's password in plain text, and cleartext transmission in the same version that exposes passwords, configurations and binaries. Talos reported command injection, information disclosure and remote code execution issues across the products, including a PFC200 cloud connectivity flaw where a crafted XML file directs the service to download and execute a shell script with root privileges, and stated it worked with WAGO to resolve the issues and make updates available.
Key Takeaway: These are controllers running automation on plant floors, and Talos believes the flaws affect the past 10 firmware versions on both the PFC100 and PFC200, possibly earlier - so the installed base, not just the latest release, is the exposure.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2019-5107 CVE-2019-5134 CVE-2019-5135 CVE-2019-5149 CVE-2019-5155
Related: Vulnerability Spotlight: A deep dive into WAGO’s cloud connectivity and the vulnerabilities that arise Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026