Skip to content
OpenAdvisories
Critical VDE-2020-036 4 CVEs

WAGO: Multiple Vulnerabilities in I/O-Check Service

Published Jun 29, 2021 · Updated May 14, 2025 · Revision 5

Vendor: WAGO Product: Edge Controller Product: PFC 100 Product: PFC200 Product: Touch Panel 600

Summary

Multiple vulnerabilities in the WAGO I/O-Check Service were reported.

Details

Impact
By exploiting the described vulnerabilities, the attacker potentially is able to manipulate or disrupt the device.

Mitigation
- Disable I/O-Check service
- Restrict network access to the device.
- Do not directly connect the device to the internet.

Solution
The I/O-Check service protocol is only needed during installation and commissioning, not during normal operations. It is highly recommended to disable the I/O-Check service after commissioning. This is the easiest and securest way to protect your device from the listed vulnerabilities and possible upcoming zero-day exploits.
Regardless to the action described above, the vulnerability has been fixed in FW18Patch3, released in June 2021.
We recommend all affected users to update to the latest firmware version.

Vulnerabilities 4

  • Critical 9.8
    CVE-2021-34569

    WAGO I/O-Check Service prone to Out-of-bounds Write

    In WAGO I/O-Check Service in multiple products an attacker can send a specially crafted packet containing OS commands to crash the diagnostic tool and write memory.

    WAGO 762-6xxx 750-81xx/xxx-xxxFW 752-8303/8000-0002 ICS / OT
  • Critical 9.1
    CVE-2021-34566

    WAGO I/O-Check Service prone to Memory Overflow

    In WAGO I/O-Check Service in multiple products an unauthenticated remote attacker can send a specially crafted packet containing OS commands to crash the iocheck process and write memory resulting in loss of integrity and DoS.

    WAGO 762-5xxx 750-82xx/xxx-xxx 762-4xxx ICS / OT
  • High 8.2
    CVE-2021-34567

    WAGO I/O-Check Service prone to Out-of-bounds Read

    In WAGO I/O-Check Service in multiple products an unauthenticated remote attacker can send a specially crafted packet containing OS commands to provoke a denial of service and an limited out-of-bounds read.

    WAGO 762-5xxx 750-82xx/xxx-xxx 762-4xxx ICS / OT
  • High 7.5
    CVE-2021-34568

    WAGO I/O-Check Service prone to Allocation of Resources Without Limits or Throttling

    In WAGO I/O-Check Service in multiple products an unauthenticated remote attacker can send a specially crafted packet containing OS commands to provoke a denial of service.

    WAGO 762-6xxx 750-81xx/xxx-xxxFW 752-8303/8000-0002 ICS / OT

Revision history

  1. #5

    Fix: added distribution

  2. #4

    Fixed csaf publisher information

  3. #3

    Fix: corrected self-reference, fixed version

  4. #2

    Fix: added self-reference

  5. #1

    Initial revision.

References