CVE-2021-34583

mediumPriorität · verfolgen · 33EPSS 0.088 · 95. PerzentilDEEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

8.84% (95th) EPSS

CVSS 5 · medium

Is it mine?

83 products

Prüfe deine Angriffsfläche

Who says so?

4 sources

cnnvd · enisa_euvd · nvd · phoenix_contact_psirt

EPSS · bewertet 2026-10-23

Crafted web server requests may cause a heap-based buffer overflow and could therefore trigger a denial-of- service condition due to a crash in the CODESYS V2 web server prior to V1.1.9.22.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

Behobenphoenix_contact_psirt
UPDATE A: fixed Firmware versions for 750-890/0xx-xxx, 750-891 and 750-893 We recommend all effected users with CODESYS 2.3 Runtime PLCs to update to the firmware version listed below. Series Ethernet Controller | Article Number | Fixed Firmware Versions | Available | |-------------------------|--------------------------|---------------------------| | 750-823 | >=FW10 | January 2022 | | 750-829 | >=FW17 | After BACnet certification | | 750-831/000-00x | >=FW17 | After BACnet certification | | 750-832/000-00x | >=FW10 | After BACnet certification | | 750-852 | >=FW17 | Q1 2022 | | 750-862 | >=FW10 | January 2022 | | 750-880/0xx-xxx | >=FW17 | Q1 2022 | | 750-881 | >=FW17 | Q1 2022 | | 750-882 | >=FW17 | Q1 2022 | | 750-885/0xx-xxx | >=FW17 | Q1 2022 | | 750-889 | >=FW17 | Q1 2022 | | 750-890/0xx-xxx | >=FW10 | January 2022 | | 750-891 | >=FW10 | January 2022 | | 750-893 | >=FW10 | January 2022 | PFC200 Controller | Article Number | Affected Firmware Versions | Approx. Available | |-------------------------|----------------------------|--------------------| | 750-8202/xxx-xxx | >=FW20 | January 2022 | | 750-8203/xxx-xxx | >=FW20 | January 2022 | | 750-8204/xxx-xxx | >=FW20 | January 2022 | | 750-8206/xxx-xxx | >=FW20 | January 2022 | | 750-8207/xxx-xxx | >=FW20 | January 2022 | | 750-8208/xxx-xxx | >=FW20 | January 2022 | | 750-8210/xxx-xxx | >=FW20 | January 2022 | | 750-8211/xxx-xxx | >=FW20 | January 2022 | | 750-8212/xxx-xxx | >=FW20 | January 2022 | | 750-8213/xxx-xxx | >=FW20 | January 2022 | | 750-8214/xxx-xxx | >=FW20 | January 2022 | | 750-8216/xxx-xxx | >=FW20 | January 2022 | | 750-8217/xxx-xxx | >=FW20 | January 2022 |
Mitigationphoenix_contact_psirt
1. Use general security best practices to protect systems from local and network attacks. 2. Do not allow direct access to the device from untrusted networks. 3. Update to the latest firmware according to the table in chapter solutions. 4. Disable the CODESYS 2.3 WebVisualisation and CODESYS 2.3 port 2455. For further impact information and risk mitigation, please refer to the official CODESYS Advisory Website at https://www.codesys.com/security/security-reports.html

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

7.5

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 5–7.5

v2.05mediumAV:N/AC:L/Au:N/C:N/I:N/A:Pprimary · NVD / NIST USAusnutzbarkeit 10 · Auswirkung 2.9

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 3.6

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · ENISA EU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · info@cert.vde.comAusnutzbarkeit 3.9 · Auswirkung 3.6

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · Phoenix Contact PSIRT DE

v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-787USprimärCWE-122USCWE-122US

betroffene Produkte (83)

Betroffene Produkte und Versionsbereiche.

CODESYS CODESYS V2all web servers → V1.1.9.22enisa_euvdEU
codesys codesys< 1.1.9.22nvdUScpe:2.3:a:codesys:codesys:*:*:*:*:*:*:*:*
wago 750-8202 firmware< fw20nvdUScpe:2.3:o:wago:750-8202_firmware:*:*:*:*:*:*:*:*
wago 750-8203 firmware< fw20nvdUScpe:2.3:o:wago:750-8203_firmware:*:*:*:*:*:*:*:*
wago 750-8204 firmware< fw20nvdUScpe:2.3:o:wago:750-8204_firmware:*:*:*:*:*:*:*:*
wago 750-8206 firmware< fw20nvdUScpe:2.3:o:wago:750-8206_firmware:*:*:*:*:*:*:*:*
wago 750-8207 firmware< fw20nvdUScpe:2.3:o:wago:750-8207_firmware:*:*:*:*:*:*:*:*
wago 750-8208 firmware< fw20nvdUScpe:2.3:o:wago:750-8208_firmware:*:*:*:*:*:*:*:*
wago 750-8210 firmware< fw20nvdUScpe:2.3:o:wago:750-8210_firmware:*:*:*:*:*:*:*:*
wago 750-8211 firmware< fw20nvdUScpe:2.3:o:wago:750-8211_firmware:*:*:*:*:*:*:*:*
wago 750-8212 firmware< fw20nvdUScpe:2.3:o:wago:750-8212_firmware:*:*:*:*:*:*:*:*
wago 750-8213 firmware< fw20nvdUScpe:2.3:o:wago:750-8213_firmware:*:*:*:*:*:*:*:*
wago 750-8214 firmware< fw20nvdUScpe:2.3:o:wago:750-8214_firmware:*:*:*:*:*:*:*:*
wago 750-8216 firmware< fw20nvdUScpe:2.3:o:wago:750-8216_firmware:*:*:*:*:*:*:*:*
wago 750-8217 firmware< fw20nvdUScpe:2.3:o:wago:750-8217_firmware:*:*:*:*:*:*:*:*
wago 750-823 firmware< fw10nvdUScpe:2.3:o:wago:750-823_firmware:*:*:*:*:*:*:*:*
wago 750-829 firmware< fw17nvdUScpe:2.3:o:wago:750-829_firmware:*:*:*:*:*:*:*:*
wago 750-831 firmware< fw17nvdUScpe:2.3:o:wago:750-831_firmware:*:*:*:*:*:*:*:*
wago 750-832 firmware< fw10nvdUScpe:2.3:o:wago:750-832_firmware:*:*:*:*:*:*:*:*
wago 750-852 firmware< fw17nvdUScpe:2.3:o:wago:750-852_firmware:*:*:*:*:*:*:*:*

20 von 83 angezeigt

Advisories (1)

Hersteller- und Ökosystem-Meldungen dazu.

VDE-2021-056WAGO: Multiple Vulnerabilities in CODESYS Runtime 2.3 and WebVisualisation2021-11-16csaf · phoenix_contact_psirtDE
Multiple vulnerabilities were reported in CODESYS 2.3 Runtime. The CODESYS 2.3 Runtime is an essential component in several WAGO PLCs. All vulnerable PLCs are listed in chapter 'Affected Products'. https://www.codesys.com/security/security-reports.html

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd nvd phoenix_contact_psirt NVD CVE.org MITRE

veröffentlicht 2021-10-26geändert 2026-06-17

verwandt (16,033)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2026-86950US	—OT kritisch	1.24% (69th)	KEV	2026-09-28
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing…
CVE-2026-87491US	—OT kritisch	3.14% (88th)	KEV	2026-09-09
Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security…
CVE-2026-53362US	—OT kritisch	0.71% (53rd)	KEV	2026-07-04
In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branc…
CVE-2026-53266US	—OT kritisch	0.83% (57th)	KEV	2026-06-25
In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite writable The ebtables SNAT target keeps the Ethernet source addre…
CVE-2026-11645US	—OT kritisch	2.44% (84th)	KEV	2026-06-09
Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium…

+16028 weitere

Referenzen (7)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan