Wago E!cockpit vulnerabilities

4 CVEs affecting Wago E!cockpit, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-5159, published 2020-03-11.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-5159, published 2020-03-11. High severity, CVSS 7.8. EPSS: 1.9% chance of exploitation in the next 30 days. An exploitable improper input validation vulnerability exists in the firmware update functionality of WAGO e!COCKPIT automation software v1.6.0.7. A specially crafted firmware update file can allow…
CVE-2019-5158, published 2020-03-11. High severity, CVSS 7.8. EPSS: 1.1% chance of exploitation in the next 30 days. An exploitable firmware downgrade vulnerability exists in the firmware update package functionality of the WAGO e!COCKPIT automation software v1.6.1.5. A specially crafted firmware update file can…
CVE-2019-5107, published 2020-03-11. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. A cleartext transmission vulnerability exists in the network communication functionality of WAGO e!Cockpit version 1.5.1.1. An attacker with access to network traffic can easily intercept, interpret,…
CVE-2019-5106, published 2020-03-11. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. A hard-coded encryption key vulnerability exists in the authentication functionality of WAGO e!Cockpit version 1.5.1.1. An attacker with access to communications between e!Cockpit and CoDeSyS Gateway…