CVE-2021-34585

HIGH

Wago 750-823 Firmware < fw10 - Denial of Service

Title source: rule

Description

In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests can trigger a parser error. Since the parser result is not checked under all conditions, a pointer dereference with an invalid address can occur. This leads to a denial of service situation.

References (2)

[Vendor Advisory] https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=16876&token=a3f1d937f95e7034879f4f2ea8e5a99b168256a7&download=

[Exploit, Third Party Advisory] https://www.tenable.com/security/research/tra-2021-47

Scores

CVSS v3 7.5

EPSS 0.0047

EPSS Percentile 64.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Classification

CWE

CWE-252

Status published

Affected Products (28)

wago/750-823_firmware < fw10

wago/750-829_firmware < fw17

wago/750-831_firmware < fw17

wago/750-832_firmware < fw10

wago/750-852_firmware < fw17

wago/750-862_firmware < fw10

wago/750-880_firmware < fw17

wago/750-881_firmware < fw17

wago/750-882_firmware < fw17

wago/750-885_firmware < fw17

wago/750-889_firmware < fw17

wago/750-890_firmware < fw10

wago/750-891_firmware < fw10

wago/750-893_firmware < fw10

wago/750-8202_firmware < fw20

... and 13 more

Timeline

Published Oct 26, 2021

Tracked Since Feb 18, 2026