Wago 750-862 Firmware vulnerabilities

24 CVEs affecting Wago 750-862 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-1620, published 2023-06-26.

More from Wago.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2021-34586, published 2021-10-26. High severity, CVSS 7.5. EPSS: 14.1% chance of exploitation in the next 30 days. In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests may cause a Null pointer dereference in the CODESYS web server and may result in a denial-of-service condition.
• CVE-2021-34583, published 2021-10-26. High severity, CVSS 7.5. EPSS: 8.4% chance of exploitation in the next 30 days. Crafted web server requests may cause a heap-based buffer overflow and could therefore trigger a denial-of- service condition due to a crash in the CODESYS V2 web server prior to V1.1.9.22.
• CVE-2021-30186, published 2021-05-25. High severity, CVSS 7.5. EPSS: 7.4% chance of exploitation in the next 30 days. CODESYS V2 runtime system SP before 2.4.7.55 has a Heap-based Buffer Overflow.
• CVE-2021-30195, published 2021-05-25. High severity, CVSS 7.5. EPSS: 7.2% chance of exploitation in the next 30 days. CODESYS V2 runtime system before 2.4.7.55 has Improper Input Validation.
• CVE-2020-12506, published 2020-09-30. Critical severity, CVSS 9.1. EPSS: 1.5% chance of exploitation in the next 30 days. Improper Authentication vulnerability in WAGO 750-8XX series with FW version <= FW03 allows an attacker to change the settings of the devices by sending specifically constructed requests without…
• CVE-2021-30190, published 2021-05-25. Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days. CODESYS V2 Web-Server before 1.1.9.20 has Improper Access Control.
• CVE-2021-30189, published 2021-05-25. Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days. CODESYS V2 Web-Server before 1.1.9.20 has a Stack-based Buffer Overflow.
• CVE-2021-30188, published 2021-05-25. Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days. CODESYS V2 runtime system SP before 2.4.7.55 has a Stack-based Buffer Overflow.
• CVE-2021-30193, published 2021-05-25. Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days. CODESYS V2 Web-Server before 1.1.9.20 has an Out-of-bounds Write.
• CVE-2021-30192, published 2021-05-25. Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days. CODESYS V2 Web-Server before 1.1.9.20 has an Improperly Implemented Security Check.

Latest

• CVE-2023-1620, published 2023-06-26. Medium severity, CVSS 4.9. EPSS: 0.9% chance of exploitation in the next 30 days. Multiple WAGO devices in multiple versions may allow an authenticated remote attacker with high privileges to DoS the device by sending a specifically crafted packet to the CODESYS V2 runtime.
• CVE-2023-1619, published 2023-06-26. Medium severity, CVSS 4.9. EPSS: 0.8% chance of exploitation in the next 30 days. Multiple WAGO devices in multiple versions may allow an authenticated remote attacker with high privileges to DoS the device by sending a malformed packet.
• CVE-2023-1150, published 2023-06-26. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. Uncontrolled resource consumption in Series WAGO 750-3x/-8x products may allow an unauthenticated remote attacker to DoS the MODBUS server with specially crafted packets.
• CVE-2021-34596, published 2021-10-26. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. A crafted request may cause a read access to an uninitialized pointer in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56, resulting in a denial-of-service condition.
• CVE-2021-34595, published 2021-10-26. High severity, CVSS 8.1. EPSS: 0.9% chance of exploitation in the next 30 days. A crafted request with invalid offsets may cause an out-of-bounds read or write access in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56, resulting in a…
• CVE-2021-34585, published 2021-10-26. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests can trigger a parser error. Since the parser result is not checked under all conditions, a pointer dereference with an…
• CVE-2021-34584, published 2021-10-26. Critical severity, CVSS 9.1. EPSS: 1.1% chance of exploitation in the next 30 days. Crafted web server requests can be utilised to read partial stack or heap memory or may trigger a denial-of- service condition due to a crash in the CODESYS V2 web server prior to V1.1.9.22.
• CVE-2021-34578, published 2021-08-31. High severity, CVSS 8.1. EPSS: 1% chance of exploitation in the next 30 days. This vulnerability allows an attacker who has access to the WBM to read and write settings-parameters of the device by sending specifically constructed requests without authentication on multiple…