Wago 750-8204 Firmware vulnerabilities

22 CVEs affecting Wago 750-8204 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-1620, published 2023-06-26.

More from Wago.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2021-34586, published 2021-10-26. High severity, CVSS 7.5. EPSS: 14.1% chance of exploitation in the next 30 days. In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests may cause a Null pointer dereference in the CODESYS web server and may result in a denial-of-service condition.
• CVE-2021-34583, published 2021-10-26. High severity, CVSS 7.5. EPSS: 8.4% chance of exploitation in the next 30 days. Crafted web server requests may cause a heap-based buffer overflow and could therefore trigger a denial-of- service condition due to a crash in the CODESYS V2 web server prior to V1.1.9.22.
• CVE-2021-30186, published 2021-05-25. High severity, CVSS 7.5. EPSS: 7.4% chance of exploitation in the next 30 days. CODESYS V2 runtime system SP before 2.4.7.55 has a Heap-based Buffer Overflow.
• CVE-2021-30195, published 2021-05-25. High severity, CVSS 7.5. EPSS: 7.2% chance of exploitation in the next 30 days. CODESYS V2 runtime system before 2.4.7.55 has Improper Input Validation.
• CVE-2021-34593, published 2021-10-26. High severity, CVSS 7.5. EPSS: 2.7% chance of exploitation in the next 30 days. In CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56 unauthenticated crafted invalid requests may result in several denial-of-service conditions. Running PLC programs…
• CVE-2021-30190, published 2021-05-25. Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days. CODESYS V2 Web-Server before 1.1.9.20 has Improper Access Control.
• CVE-2021-30189, published 2021-05-25. Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days. CODESYS V2 Web-Server before 1.1.9.20 has a Stack-based Buffer Overflow.
• CVE-2021-30188, published 2021-05-25. Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days. CODESYS V2 runtime system SP before 2.4.7.55 has a Stack-based Buffer Overflow.
• CVE-2021-30193, published 2021-05-25. Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days. CODESYS V2 Web-Server before 1.1.9.20 has an Out-of-bounds Write.
• CVE-2021-30192, published 2021-05-25. Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days. CODESYS V2 Web-Server before 1.1.9.20 has an Improperly Implemented Security Check.

Latest

• CVE-2023-1620, published 2023-06-26. Medium severity, CVSS 4.9. EPSS: 0.9% chance of exploitation in the next 30 days. Multiple WAGO devices in multiple versions may allow an authenticated remote attacker with high privileges to DoS the device by sending a specifically crafted packet to the CODESYS V2 runtime.
• CVE-2023-1619, published 2023-06-26. Medium severity, CVSS 4.9. EPSS: 0.8% chance of exploitation in the next 30 days. Multiple WAGO devices in multiple versions may allow an authenticated remote attacker with high privileges to DoS the device by sending a malformed packet.
• CVE-2020-12069, published 2022-12-26. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system stores the online communication passwords using a weak hashing algorithm. This can…
• CVE-2021-34596, published 2021-10-26. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. A crafted request may cause a read access to an uninitialized pointer in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56, resulting in a denial-of-service condition.
• CVE-2021-34595, published 2021-10-26. High severity, CVSS 8.1. EPSS: 0.9% chance of exploitation in the next 30 days. A crafted request with invalid offsets may cause an out-of-bounds read or write access in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56, resulting in a…
• CVE-2021-34585, published 2021-10-26. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests can trigger a parser error. Since the parser result is not checked under all conditions, a pointer dereference with an…
• CVE-2021-34584, published 2021-10-26. Critical severity, CVSS 9.1. EPSS: 1.1% chance of exploitation in the next 30 days. Crafted web server requests can be utilised to read partial stack or heap memory or may trigger a denial-of- service condition due to a crash in the CODESYS V2 web server prior to V1.1.9.22.