CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2021-34593
High (7.5). EPSS 2.7% chance of exploitation in the next 30 days.
In CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56 unauthenticated crafted invalid requests may result in several denial-of-service conditions. Running PLC programs may be stopped, memory may be leaked, or further communication clients may be blocked from accessing the PLC.
Severity
- EPSS
- 2.7% chance of exploitation in the next 30 days; higher than 85% of CVEs (scores of 2026-10-31)
- CWE
- CWE-755
- Published
- Modified
- Record from
- the NVD, synced
Affected
- codesys:plcwinnt
- codesys:runtime_toolkit
- wago:750-8202_firmware
- wago:750-8203_firmware
- wago:750-8204_firmware
- wago:750-8206_firmware
- wago:750-8207_firmware
- wago:750-8208_firmware
- wago:750-8210_firmware
- wago:750-8211_firmware
- wago:750-8212_firmware
- wago:750-8213_firmware
- wago:750-8214_firmware
- wago:750-8216_firmware
- wago:750-8217_firmware
References
- http://packetstormsecurity.com/files/164716/CODESYS-2.4.7.0-Denial-Of-Service.html
- http://packetstormsecurity.com/files/165874/WAGO-750-8xxx-PLC-Denial-Of-Service-User-Enumeration.html
- http://seclists.org/fulldisclosure/2021/Oct/64
- https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=16877&token=8faab0fc1e069f4edfca5d5aba8146139f67a175&download=
- http://packetstormsecurity.com/files/164716/CODESYS-2.4.7.0-Denial-Of-Service.html