CVE-2019-18202

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-10-19 · updated 2026-06-17

Description

Information Disclosure is possible on WAGO Series PFC100 and PFC200 devices before FW12 due to improper access control. A remote attacker can check for the existence of paths and file names via crafted HTTP requests.

Affected products

WAGO Pfc Firmware: before 03.00.35\(12\) — fixed in 03.00.35\(12\)

How to fix

Upgrade to a fixed version: WAGO Pfc Firmware 03.00.35\(12\). Check the vendor advisory for mitigations.

References

https://cert.vde.com/de-de/advisories/vde-2019-017
https://cert.vde.com/de-de/advisories/vde-2019-017

Get alerted when CVE-2019-18202 or the next vulnerability affects your stack