CVE-2021-34584: CODESYS V2 web server: crafted requests could trigger a buffer over-read (DoS)
Published Oct 26, 2021
·Updated
Crafted web server requests can be utilised to read partial stack or heap memory or may trigger a denial-of- service condition due to a crash in the CODESYS V2 web server prior to V1.1.9.22.
Affected Software
55 affected components
CODESYS CODESYS<1.1.9.22
All of the following
WAGO 750-823 Firmware<fw10
WAGO 750-823
All of the following
WAGO 750-829 Firmware<fw17
WAGO 750-829
All of the following
WAGO 750-831 Firmware<fw17
WAGO 750-831
All of the following
WAGO 750-832 Firmware<fw10
WAGO 750-832
All of the following
WAGO 750-852 Firmware<fw17
WAGO 750-852
All of the following
WAGO 750-862 Firmware<fw10
WAGO 750-862
All of the following
WAGO 750-880 Firmware<fw17
WAGO 750-880
All of the following
WAGO 750-881 Firmware<fw17
WAGO 750-881
All of the following
WAGO 750-882 Firmware<fw17
WAGO 750-882
All of the following
WAGO 750-885 Firmware<fw17
WAGO 750-885
All of the following
WAGO 750-889 Firmware<fw17
WAGO 750-889
All of the following
WAGO 750-890 Firmware<fw10
WAGO 750-890
All of the following
WAGO 750-891 Firmware<fw10
WAGO 750-891
All of the following
WAGO 750-893 Firmware<fw10
WAGO 750-893
All of the following
WAGO 750-8202 Firmware<fw20
WAGO 750-8202
All of the following
WAGO 750-8203 Firmware<fw20
WAGO 750-8203
All of the following
WAGO 750-8204 Firmware<fw20
WAGO 750-8204
All of the following
WAGO 750-8206 Firmware<fw20
WAGO 750-8206
All of the following
WAGO 750-8207 Firmware<fw20
WAGO 750-8207
All of the following
WAGO 750-8208 Firmware<fw20
WAGO 750-8208
All of the following
WAGO 750-8210 Firmware<fw20
WAGO 750-8210
All of the following
WAGO 750-8211 Firmware<fw20
WAGO 750-8211
All of the following
WAGO 750-8212 Firmware<fw20
WAGO 750-8212
All of the following
WAGO 750-8213 Firmware<fw20
WAGO 750-8213
All of the following
WAGO 750-8214 Firmware<fw20
WAGO 750-8214
All of the following
WAGO 750-8216 Firmware<fw20
WAGO 750-8216
All of the following
WAGO 750-8217 Firmware<fw20
WAGO 750-8217
Remediation
Information
CODESYS GmbH has released version V1.1.9.22 of the CODESYS V2 web server to solve the noted vulnerability issues. This version of the CODESYS V2 web server is also part of the CODESYS Development System setup version V2.3.9.68.
Event History
Oct 26, 2021
CVE Published
via MITRE·09:55 AM
Data Sourced
via MITRE·09:55 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·10:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2021-34584?
CVE-2021-34584 is rated as a high severity vulnerability because it can lead to exposure of sensitive memory data or denial-of-service conditions.
2
How do I fix CVE-2021-34584?
To fix CVE-2021-34584, upgrade the CODESYS V2 web server to version 1.1.9.22 or later.
3
What types of attacks can exploit CVE-2021-34584?
CVE-2021-34584 can be exploited through crafted web server requests to read sensitive memory or cause crashes.
4
What is affected by CVE-2021-34584?
CVE-2021-34584 affects CODESYS versions prior to 1.1.9.22.
5
Are there workarounds for CVE-2021-34584?
There are no known effective workarounds for CVE-2021-34584 beyond upgrading to a patched version.