CVE-2019-5186

An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service "I/O-Check" functionality of WAGO PFC 200. An attacker can send a specially crafted packet to trigger the parsing of this cache file.At 0x1eb9c the extracted interface element name from the xml file is used as an argument to /etc/config-tools/config_interfaces interface=<contents of interface element> using sprintf(). The destination buffer sp+0x40 is overflowed with the call to sprintf() for any interface values that are greater than 512-len("/etc/config-tools/config_interfaces interface=") in length. Later, at 0x1ea08 strcpy() is used to copy the contents of the stack buffer that was overflowed sp+0x40 into sp+0x440. The buffer sp+0x440 is immediately adjacent to sp+0x40 on the stack. Therefore, there is no NULL termination on the buffer sp+0x40 since it overflowed into sp+0x440. The strcpy() will result in invalid memory access. An interface value of length 0x3c4 will cause the service to crash.

• CWE-120
• CWE-787

• https://talosintelligence.com/vulnerability_reports/TALOS-2019-0966Exploit, Mitigation, Third Party Advisory
• https://talosintelligence.com/vulnerability_reports/TALOS-2019-0966Exploit, Mitigation, Third Party Advisory

Published

Mar 23, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-5180An exploitable stack buffer overflow vulnerability vulnerabi…7.8
• CVE-2019-5181An exploitable stack buffer overflow vulnerability vulnerabi…7.8
• CVE-2019-5182An exploitable stack buffer overflow vulnerability vulnerabi…5.5
• CVE-2019-5183An exploitable type confusion vulnerability exists in AMD AT…9
• CVE-2019-5184An exploitable double free vulnerability exists in the ioche…7.8
• CVE-2019-5185An exploitable stack buffer overflow vulnerability vulnerabi…7
• CVE-2019-5187An exploitable out-of-bounds write vulnerability exists in t…8.8
• CVE-2019-5188A code execution vulnerability exists in the directory rehas…6.7
• CVE-2019-5205Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-5206Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-5207Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-5208Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…