CVE-2021-34566

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

In WAGO I/O-Check Service in multiple products an unauthenticated remote attacker can send a specially crafted packet containing OS commands to crash the iocheck process and write memory resulting in loss of integrity and DoS.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-120

Affected software

VendorProductVersions
WAGO750-81xx/xxx-xxxFW>= FW1, <= FW18 Patch 2
WAGO750-82xx/xxx-xxx>= FW1, <= FW18 Patch 2
WAGO752-8303/8000-0002>= FW1, <= FW18 Patch 2
WAGO762-4xxx>= FW1, <= FW18 Patch 2
WAGO762-5xxx>= FW1, <= FW18 Patch 2
WAGO762-6xxx>= FW1, <= FW18 Patch 2

References

Timeline

Published
Nov 9, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-345678.2In WAGO I/O-Check Service in multiple products an unauthenticated remote attacker can send a specially crafted packet containing OS commandsCVE-2021-345687.5In WAGO I/O-Check Service in multiple products an unauthenticated remote attacker can send a specially crafted packet containing OS commandsCVE-2021-345699.8In WAGO I/O-Check Service in multiple products an attacker can send a specially crafted packet containing OS commands to crash the diagnostiCVE-2021-34576.1An improper authorization handling flaw was found in Foreman. The Shellhooks plugin for the smart-proxy allows Foreman clients to execute acCVE-2021-345707.5Multiple Phoenix Contact PLCnext control devices in versions prior to 2021.0.5 LTS are prone to a DoS attack through special crafted JSON reCVE-2021-345716.5Multiple Wireless M-Bus devices by Enbra use Hard-coded Credentials in Security mode 5 without an option to change the encryption key. An adCVE-2021-345726.5Enbra EWM 1.7.29 does not check for or detect replay attacks sent by wireless M-Bus Security mode 5 devices. Instead timestamps of the sensoCVE-2021-345735.5In Enbra EWM in Version 1.7.29 together with several tested wireless M-Bus Sensors the events backflow and "no flow" are not reconized or miCVE-2021-345744.3In MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2 an authenticated attaCVE-2021-345757.5In MB connect line mymbCONNECT24, mbCONNECT24 in versions <= 2.8.0 an unauthenticated user can enumerate valid users by checking what kind oCVE-2021-345764.3In Kaden PICOFLUX Air in all known versions an information exposure through observable discrepancy exists. This may give sensitive informatiCVE-2021-345776.5In the Kaden PICOFLUX AiR water meter an adversary can read the values through wireless M-Bus mode 5 with a hardcoded shared key while being
CVE-2021-34566: Critical severity, CVSS 9.1 | Vulnix