CVE-2021-34593: Codesys Plcwinnt

High severity, CVSS 7.5. EPSS: 2.7% chance of exploitation in the next 30 days.

In CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56 unauthenticated crafted invalid requests may result in several denial-of-service conditions. Running PLC programs may be stopped, memory may be leaked, or further communication clients may be blocked from accessing the PLC.

Affected products

• Codesys Plcwinnt: before 2.4.7.56 (fixed in 2.4.7.56)
• Codesys Runtime Toolkit: before 2.4.7.56 (fixed in 2.4.7.56)
• Wago 750-8202 Firmware: before fw20 (fixed in fw20)
• Wago 750-8203 Firmware: before fw20 (fixed in fw20)
• Wago 750-8204 Firmware: before fw20 (fixed in fw20)
• Wago 750-8206 Firmware: before fw20 (fixed in fw20)
• Wago 750-8207 Firmware: before fw20 (fixed in fw20)
• Wago 750-8208 Firmware: before fw20 (fixed in fw20)
• Wago 750-8210 Firmware: before fw20 (fixed in fw20)
• Wago 750-8211 Firmware: before fw20 (fixed in fw20)
• Wago 750-8212 Firmware: before fw20 (fixed in fw20)
• Wago 750-8213 Firmware: before fw20 (fixed in fw20)
• Wago 750-8214 Firmware: before fw20 (fixed in fw20)
• Wago 750-8216 Firmware: before fw20 (fixed in fw20)
• Wago 750-8217 Firmware: before fw20 (fixed in fw20)

Published 2021-10-26. Last modified 2026-06-17.