CVE-2019-5149

Name of the Vulnerable Software and Affected Versions WAGO PFC100 versions prior to 03.02.02 WAGO PFC2000 versions prior to 03.01.07

Description The WBM web application runs on a lighttpd web server and uses the FastCGI module to provide high performance for Internet applications. However, the default configuration of this module limits the number of concurrent php-cgi processes to two, which can be abused to cause a denial of service of the entire web server.

Recommendations For WAGO PFC100 versions prior to 03.02.02, update to version 03.02.02 or later to resolve the issue. For WAGO PFC2000 versions prior to 03.01.07, update to version 03.01.07 or later to resolve the issue. As a temporary workaround, consider restricting access to the FastCGI module to minimize the risk of exploitation.