CVE-2019-5158

An exploitable firmware downgrade vulnerability exists in the firmware update package functionality of the WAGO e!COCKPIT automation software v1.6.1.5. A specially crafted firmware update file can allow an attacker to install an older firmware version while the user thinks a newer firmware version is being installed. An attacker can create a custom firmware update package with invalid metadata in order to trigger this vulnerability.

CVSS v3 7.8 HIGH
CVSS v2.0 4.3 MEDIUM

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://talosintelligence.com/vulnerability_reports/TALOS-2019-0951	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:wago:e\!cockpit:1.6.1.5:*:*:*:*:*:*:*

History

No history.

Information

Published : 2020-03-11 22:27

Updated : 2023-12-10 13:13

NVD link : CVE-2019-5158

Mitre link : CVE-2019-5158

CVE.ORG link : CVE-2019-5158

JSON object : View

Products Affected

wago

e\!cockpit

CWE

CWE-798

Use of Hard-coded Credentials

{"id": "CVE-2019-5158", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2020-03-11T22:27:40.957", "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2019-0951", "tags": ["Third Party Advisory"], "source": "talos-cna@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "An exploitable firmware downgrade vulnerability exists in the firmware update package functionality of the WAGO e!COCKPIT automation software v1.6.1.5. A specially crafted firmware update file can allow an attacker to install an older firmware version while the user thinks a newer firmware version is being installed. An attacker can create a custom firmware update package with invalid metadata in order to trigger this vulnerability."}, {"lang": "es", "value": "Existe una vulnerabilidad de degradaci\u00f3n de firmware explotable en la funcionalidad de paquete de actualizaci\u00f3n de firmware del software de automatizaci\u00f3n WAGO e!COCKPIT versi\u00f3n v1.6.1.5. Un archivo de actualizaci\u00f3n de firmware especialmente dise\u00f1ado puede permitir a un atacante instalar una versi\u00f3n de firmware anterior mientras el usuario cree que est\u00e1 siendo instalada una versi\u00f3n de firmware m\u00e1s nueva. Un atacante puede crear un paquete de actualizaci\u00f3n de firmware personalizado con metadatos no v\u00e1lidos a fin de desencadenar esta vulnerabilidad."}], "lastModified": "2020-03-17T15:37:11.750", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wago:e\\!cockpit:1.6.1.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E599A708-F8D2-48C9-9DC6-8A72662AE352"}], "operator": "OR"}]}], "sourceIdentifier": "talos-cna@cisco.com"}