Riskcovery

CVE-2021-21000

WAGO: PFC200 Denial of Service due to the number of connections to the runtime

State
Published
Severity
5.3 Medium
Published
May 24, 2021
Updated
Sep 16, 2024
Reserved
Dec 17, 2020

Read the record on cve.org

Description

On WAGO PFC200 devices in different firmware versions with special crafted packets an attacker with network access to the device could cause a denial of service for the login service of the runtime.

Scores

CVSSScoreVectorSource
3.15.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LCERTVDE

Weaknesses

  • CWE-770 Allocation of Resources Without Limits or Throttling

Affected Products

ProductVersions
Series PFC200 ControllerWAGO
  • 750-823 through FW07Affected
  • 750-829 through FW14Affected
  • 750-831/000-00x through FW14Affected
  • 750-832/000-00x through FW06Affected
  • 750-852 through FW14Affected
  • 750-862 through FW07Affected
  • 750-880/0xx-xxx through FW15Affected
  • 750-881 through FW14Affected
  • 750-882 through FW14Affected
  • 750-885/0xx-xxx through FW14Affected
  • 750-889 through FW14Affected
  • 750-890/0xx-xxx through FW07Affected
  • 750-891 through FW07Affected
  • 750-893 through FW07Affected
Series Ethernet ControllerWAGO
  • 750-8202/xxx-xxx to before 03.06.19 (18)Affected
  • 750-8203/xxx-xxx to before 03.06.19 (18)Affected
  • 750-8204/xxx-xxx to before 03.06.19 (18)Affected
  • 750-8206/xxx-xxx to before 03.06.19 (18)Affected
  • 750-8207/xxx-xxx to before 03.06.19 (18)Affected
  • 750-8208/xxx-xxx to before 03.06.19 (18)Affected
  • 750-8210/xxx-xxx to before 03.06.19 (18)Affected
  • 750-8211/xxx-xxx to before 03.06.19 (18)Affected
  • 750-8212/xxx-xxx to before 03.06.19 (18)Affected
  • 750-8213/xxx-xxx to before 03.06.19 (18)Affected
  • 750-8214/xxx-xxx to before 03.06.19 (18)Affected
  • 750-8216/xxx-xxx to before 03.06.19 (18)Affected
  • 750-8217/xxx-xxx to before 03.06.19 (18)Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.