CVE-2021-34585: Codesys

High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days.

In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests can trigger a parser error. Since the parser result is not checked under all conditions, a pointer dereference with an invalid address can occur. This leads to a denial of service situation.

Affected products

• Codesys Codesys: before 1.1.9.22 (fixed in 1.1.9.22)
• Wago 750-8202 Firmware: before fw20 (fixed in fw20)
• Wago 750-8203 Firmware: before fw20 (fixed in fw20)
• Wago 750-8204 Firmware: before fw20 (fixed in fw20)
• Wago 750-8206 Firmware: before fw20 (fixed in fw20)
• Wago 750-8207 Firmware: before fw20 (fixed in fw20)
• Wago 750-8208 Firmware: before fw20 (fixed in fw20)
• Wago 750-8210 Firmware: before fw20 (fixed in fw20)
• Wago 750-8211 Firmware: before fw20 (fixed in fw20)
• Wago 750-8212 Firmware: before fw20 (fixed in fw20)
• Wago 750-8213 Firmware: before fw20 (fixed in fw20)
• Wago 750-8214 Firmware: before fw20 (fixed in fw20)
• Wago 750-8216 Firmware: before fw20 (fixed in fw20)
• Wago 750-8217 Firmware: before fw20 (fixed in fw20)
• Wago 750-823 Firmware: before fw10 (fixed in fw10)
• Wago 750-829 Firmware: before fw17 (fixed in fw17)
• Wago 750-831 Firmware: before fw17 (fixed in fw17)
• Wago 750-832 Firmware: before fw10 (fixed in fw10)
• Wago 750-852 Firmware: before fw17 (fixed in fw17)
• Wago 750-862 Firmware: before fw10 (fixed in fw10)
• Wago 750-880 Firmware: before fw17 (fixed in fw17)
• Wago 750-881 Firmware: before fw17 (fixed in fw17)
• Wago 750-882 Firmware: before fw17 (fixed in fw17)
• Wago 750-885 Firmware: before fw17 (fixed in fw17)
• Wago 750-889 Firmware: before fw17 (fixed in fw17)
• and 3 more

Published 2021-10-26. Last modified 2026-06-17.