Firmware Downgrade Vulnerability in WAGO e!COCKPIT Automation Software
CVE-2019-5158

7.8HIGH

Key Information:

Vendor
Wago
Status
Wago E!cockpit
Vendor
CVE Published:
11 March 2020

Summary

This vulnerability allows attackers to exploit the firmware update process in WAGO's e!COCKPIT automation software, specifically in version 1.6.1.5. By crafting a malicious firmware update package with manipulated metadata, an attacker can deceive users during the firmware installation. This may lead to the installation of an older version of firmware, potentially reintroducing known vulnerabilities and causing operational issues.

Affected Version(s)

WAGO e!COCKPIT 1.6.1.5

References

https://talosintelligence.com/vulnerability_reports/TALOS...
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.