Description
Multiple WAGO devices in multiple versions may allow an authenticated remote attacker with high privileges to DoS the device by sending a specifically crafted packet to the CODESYS V2 runtime.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Wago | 750-8202/xxx-xxx | FW1 – ≤ FW22 SP1 | — |
| Wago | 750-8203/xxx-xxx | FW1 – ≤ FW22 SP1 | — |
| Wago | 750-8204/xxx-xxx | FW1 – ≤ FW22 SP1 | — |
| Wago | 750-8206/xxx-xxx | FW1 – ≤ FW22 SP1 | — |
| Wago | 750-8207/xxx-xxx | FW1 – ≤ FW22 SP1 | — |
| Wago | 750-8208/xxx-xxx | FW1 – ≤ FW22 SP1 | — |
| Wago | 750-8210/xxx-xxx | FW1 – ≤ FW22 SP1 | — |
| Wago | 750-8211/xxx-xxx | FW1 – ≤ FW22 SP1 | — |
| Wago | 750-8212/xxx-xxx | FW1 – ≤ FW22 SP1 | — |
| Wago | 750-8213/xxx-xxx | FW1 – ≤ FW22 SP1 | — |
| Wago | 750-8214/xxx-xxx | FW1 – ≤ FW22 SP1 | — |
| Wago | 750-8216/xxx-xxx | FW1 – ≤ FW22 SP1 | — |
| Wago | 750-8217/xxx-xxx | FW1 – ≤ FW22 SP1 | — |
| Wago | 750-823 | FW1 – ≤ FW10 | — |
| Wago | 750-332 | FW1 – ≤ FW6 | — |
| Wago | 750-832/xxx-xxx | FW1 – ≤ FW6 | — |
| Wago | 750-862 | FW1 – ≤ FW10 | — |
| Wago | 750-890/xxx-xxx | FW1 – ≤ FW10 | — |
| Wago | 750-891 | FW1 – ≤ FW10 | — |
| Wago | 750-893 | FW1 – ≤ FW10 | — |
| Wago | 750-331 | FW1 – ≤ FW14 | — |
| Wago | 750-829 | FW1 – ≤ FW14 | — |
| Wago | 750-831/xxx-xxx | FW1 – ≤ FW14 | — |
| Wago | 750-852 | FW1 – ≤ FW16 | — |
| Wago | 750-880/xxx-xxx | FW1 – ≤ FW16 | — |
| Wago | 750-881 | FW1 – ≤ FW16 | — |
| Wago | 750-882 | FW1 – ≤ FW16 | — |
| Wago | 750-885/xxx-xxx | FW1 – ≤ FW16 | — |
| Wago | 750-889 | FW1 – ≤ FW16 | — |
Advisories 1
- VDE-2023-006 WAGO: Controller with CODESYS 2.3 Runtime Denial-of-Service CERT@VDE · Jul 8, 2024
References
- https://cert.vde.com/en/advisories/VDE-2023-006/ vendor-advisory