Skip to content
OpenAdvisories
Critical VDE-2021-014 12 CVEs

WAGO: Multiple Vulnerabilities in CODESYS Runtime 2.3

Published May 20, 2021 · Updated May 22, 2025 · Revision 2

Vendor: WAGO Product: 750-8202/xxx-xxx Product: 750-8203/xxx-xxx Product: 750-8204/xxx-xxx Product: 750-8206/xxx-xxx Product: 750-8207/xxx-xxx Product: 750-8208/xxx-xxx Product: 750-8210/xxx-xxx Product: 750-8211/xxx-xxx Product: 750-8212/xxx-xxx Product: 750-8213/xxx-xxx Product: 750-8214/xxx-xxx Product: 750-8216/xxx-xxx Product: 750-8217/xxx-xxx Product: 750-823 Product: 750-829 Product: 750-831/000-00x Product: 750-832/000-00x Product: 750-852 Product: 750-862 Product: 750-880/0xx-xxx Product: 750-881 Product: 750-882 Product: 750-885/0xx-xxx Product: 750-889 Product: 750-890/0xx-xxx Product: 750-891 Product: 750-893

Summary

Multiple vulnerabilities were reported in CODESYS 2.3 Runtime. The CODESYS 2.3 Runtime is an essential component in several WAGO PLC's.

Details

Impact
The reported vulnerabilities allow an attacker who has access to the device and is able to exploit the vulnerabilities, to manipulate and disrupt the CODESYS 2.3 Runtime.

Remediation
WAGO recommends all effected users with CODESYS 2.3 Runtime PLCs to update to the firmware version listed below.

Series Ethernet Controller:
**Article No.** | **Fixed Version** | **Available** |
|-----------------------|-------------------|----------------|
| 750-823 | >=FW08 | June 2021 |
| 750-829 | >=FW15 | May 2021 |
| 750-831/000-00x | >=FW15 | May 2021 |
| 750-832/000-00x | >=FW08 | June 2021 |
| 750-852 | >=FW15 | May 2021 |
| 750-862 | >=FW08 | June 2021 |
| 750-880/0xx-xxx | >=FW16 | May 2021 |
| 750-881 | >=FW15 | May 2021 |
| 750-882 | >=FW15 | May 2021 |
| 750-885/0xx-xxx | >=FW15 | May 2021 |
| 750-889 | >=FW15 | May 2021 |
| 750-890/0xx-xxx | >=FW08 | June 2021 |
| 750-891 | >=FW08 | June 2021 |
| 750-893 | >=FW08 | June 2021 |

Series PFC200 Controller
| **Article No.** | **Fixed Patch** | **Patch Available** | **Fixed Firmware** | **Firmware Approx. Available** |
|------------------------|-----------------------|----------------------|--------------------|---------------------------------|
| 750-8202/xxx-xxx | >=03.06.19 (18) | May 2021 | >=FW19 | August 2021 |
| 750-8203/xxx-xxx | >=03.06.19 (18) | May 2021 | >=FW19 | August 2021 |
| 750-8204/xxx-xxx | >=03.06.19 (18) | May 2021 | >=FW19 | August 2021 |
| 750-8206/xxx-xxx | >=03.06.19 (18) | May 2021 | >=FW19 | August 2021 |
| 750-8207/xxx-xxx | >=03.06.19 (18) | May 2021 | >=FW19 | August 2021 |
| 750-8208/xxx-xxx | >=03.06.19 (18) | May 2021 | >=FW19 | August 2021 |
| 750-8210/xxx-xxx | >=03.06.19 (18) | May 2021 | >=FW19 | August 2021 |
| 750-8211/xxx-xxx | >=03.06.19 (18) | May 2021 | >=FW19 | August 2021 |
| 750-8212/xxx-xxx | >=03.06.19 (18) | May 2021 | >=FW19 | August 2021 |
| 750-8213/xxx-xxx | >=03.06.19 (18) | May 2021 | >=FW19 | August 2021 |
| 750-8214/xxx-xxx | >=03.06.19 (18) | May 2021 | >=FW19 | August 2021 |
| 750-8216/xxx-xxx | >=03.06.19 (18) | May 2021 | >=FW19 | August 2021 |
| 750-8217/xxx-xxx | >=03.06.19 (18) | May 2021 | >=FW19 | August 2021 |

Mitigation
1. Use general security best practices to protect systems from local and network attacks.
2. Do not allow direct access to the device from untrusted networks.
3. Update to the latest firmware according to the table in chapter solutions.
4. Disable the CODESYS 2.3 Web-Visualisation and CODESYS 2.3 port 2455.

For further impact information and risk mitigation, please refer to the official CODESYS Advisory Website at https://www.codesys.com/security/security-reports.html external link

Vulnerabilities 12

  • Critical 9.1
    CVE-2021-21001

    WAGO: PFC200 Access to files outside the home directory

    On WAGO PFC200 devices in different firmware versions with special crafted packets an authorised attacker with network access to the device can access the file system with higher privileges.

    WAGO Series PFC200 Controller Series Ethernet Controller ICS / OT
  • Medium 5.3
    CVE-2021-21000

    WAGO: PFC200 Denial of Service due to the number of connections to the runtime

    On WAGO PFC200 devices in different firmware versions with special crafted packets an attacker with network access to the device could cause a denial of service for the login service of the runtime.

    WAGO Series Ethernet Controller Series PFC200 Controller ICS / OT
  • Unscored —
    CVE-2021-30186

    CODESYS V2 runtime system SP before 2.4.7.55 has a Heap-based Buffer Overflow.

  • Unscored —
    CVE-2021-30187

    CODESYS V2 runtime system SP before 2.4.7.55 has Improper Neutralization of Special Elements used in an OS Command.

  • Unscored —
    CVE-2021-30188

    CODESYS V2 runtime system SP before 2.4.7.55 has a Stack-based Buffer Overflow.

  • Unscored —
    CVE-2021-30189

    CODESYS V2 Web-Server before 1.1.9.20 has a Stack-based Buffer Overflow.

  • Unscored —
    CVE-2021-30190

    CODESYS V2 Web-Server before 1.1.9.20 has Improper Access Control.

  • Unscored —
    CVE-2021-30191

    CODESYS V2 Web-Server before 1.1.9.20 has a a Buffer Copy without Checking the Size of the Input.

  • Unscored —
    CVE-2021-30192

    CODESYS V2 Web-Server before 1.1.9.20 has an Improperly Implemented Security Check.

  • Unscored —
    CVE-2021-30193

    CODESYS V2 Web-Server before 1.1.9.20 has an Out-of-bounds Write.

  • Unscored —
    CVE-2021-30194

    CODESYS V2 Web-Server before 1.1.9.20 has an Out-of-bounds Read.

  • Unscored —
    CVE-2021-30195

    CODESYS V2 runtime system before 2.4.7.55 has Improper Input Validation.

Revision history

  1. #2

    Fix: version space, added distribution, quotation mark

  2. #1

    Initial revision.

References