CVE-2021-34595
High
Description
A crafted request with invalid offsets may cause an out-of-bounds read or write access in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56, resulting in a denial-of-service condition or local memory overwrite.
SeverityHigh
CVSS8.1
Exploit probability—
ProductCodesys
PublishedOct 26, 2021
First seenOct 26, 2021
Weakness typeCWE-823CWE-823
How to fix
Update
- codesys codesys1.1.9.22 or later
- wago 750-823_firmwarefw10 or later
- wago 750-829_firmwarefw17 or later
- wago 750-831_firmwarefw17 or later
- wago 750-832_firmwarefw10 or later
- wago 750-852_firmwarefw17 or later
- wago 750-862_firmwarefw10 or later
- wago 750-880_firmwarefw17 or later
- wago 750-881_firmwarefw17 or later
- wago 750-882_firmwarefw17 or later
- wago 750-885_firmwarefw17 or later
- wago 750-889_firmwarefw17 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| codesys codesys | v < 1.1.9.22 | 1.1.9.22 |
| wago 750-823_firmware | v < fw10 | fw10 |
| wago 750-829_firmware | v < fw17 | fw17 |
| wago 750-831_firmware | v < fw17 | fw17 |
| wago 750-832_firmware | v < fw10 | fw10 |
| wago 750-852_firmware | v < fw17 | fw17 |
| wago 750-862_firmware | v < fw10 | fw10 |
| wago 750-880_firmware | v < fw17 | fw17 |
| wago 750-881_firmware | v < fw17 | fw17 |
| wago 750-882_firmware | v < fw17 | fw17 |
| wago 750-885_firmware | v < fw17 | fw17 |
| wago 750-889_firmware | v < fw17 | fw17 |
| wago 750-890_firmware | v < fw10 | fw10 |
| wago 750-891_firmware | v < fw10 | fw10 |
| wago 750-893_firmware | v < fw10 | fw10 |
| wago 750-8202_firmware | v < fw20 | fw20 |
| wago 750-8203_firmware | v < fw20 | fw20 |
| wago 750-8204_firmware | v < fw20 | fw20 |
| wago 750-8206_firmware | v < fw20 | fw20 |
| wago 750-8207_firmware | v < fw20 | fw20 |
| wago 750-8208_firmware | v < fw20 | fw20 |
| wago 750-8210_firmware | v < fw20 | fw20 |
| wago 750-8211_firmware | v < fw20 | fw20 |
| wago 750-8212_firmware | v < fw20 | fw20 |
| wago 750-8213_firmware | v < fw20 | fw20 |
| wago 750-8214_firmware | v < fw20 | fw20 |
| wago 750-8216_firmware | v < fw20 | fw20 |
| wago 750-8217_firmware | v < fw20 | fw20 |
| codesys plcwinnt | v < 2.4.7.56 | 2.4.7.56 |
| codesys runtime_toolkit | v < 2.4.7.56 | 2.4.7.56 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.