Read the docs
TI-2018-06378 Aliases CVE-2018-8836GHSA-pm5g-66xr-995q

Wago 750 Series PLCs with firmware version 10 and prior include a remote attack may take…

Priority LOW 30CWE-404Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-404.

Summary

Wago 750 Series PLCs with firmware version 10 and prior include a remote attack may take advantage of an improper implementation of the 3 way handshake during a TCP connection affecting the communications with commission and service tools. Specially crafted packets may also be sent to Port 2455/TCP/IP, used in Codesys management software, which may result in a denial-of-service condition of communications with commissioning and service tools.

Why it matters now

EPSS 0.03712 89th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
WAGOWAGO 750 Series750-880 firmware version 10 and prior; 750-881 firmware version 10 and prior; 750-852 firmware version 10 and prior; 750-882 firmware version 10 and prior; 750-885 firmware version 10 and prior; 750-831 firmware version 10 and prior; 750-889 firmware version 10 and prior; 750-829 firmware version 10 and prior—No fix listedCNA
  • WAGO 750 Series VendorWAGO Affected 750-880 firmware version 10 and prior; 750-881 firmware version 10 and prior; 750-852 firmware version 10 and prior; 750-882 firmware version 10 and prior; 750-885 firmware version 10 and prior; 750-831 firmware version 10 and prior; 750-889 firmware version 10 and prior; 750-829 firmware version 10 and prior Fixed in — No fix listed CNA

CPE configurations NVD · 16

CPEVersionsRoleVendor
cpe:2.3:o:wago:750-880_firmware:*:*:*:*:*:*:*:*up to 10VulnerableWAGO
cpe:2.3:h:wago:750-880:-:*:*:*:*:*:*:*not specified by NVDRunning onWAGO
cpe:2.3:o:wago:750-881_firmware:*:*:*:*:*:*:*:*up to 10VulnerableWAGO
cpe:2.3:h:wago:750-881:-:*:*:*:*:*:*:*not specified by NVDRunning onWAGO
cpe:2.3:o:wago:750-852_firmware:*:*:*:*:*:*:*:*up to 10VulnerableWAGO
cpe:2.3:h:wago:750-852:-:*:*:*:*:*:*:*not specified by NVDRunning onWAGO
cpe:2.3:o:wago:750-882_firmware:*:*:*:*:*:*:*:*up to 10VulnerableWAGO
cpe:2.3:h:wago:750-882:-:*:*:*:*:*:*:*not specified by NVDRunning onWAGO
cpe:2.3:o:wago:750-885_firmware:*:*:*:*:*:*:*:*up to 10VulnerableWAGO
cpe:2.3:h:wago:750-885:-:*:*:*:*:*:*:*not specified by NVDRunning onWAGO
  • cpe:2.3:o:wago:750-880_firmware:*:*:*:*:*:*:*:* Versions up to 10 Vulnerable ·WAGO
  • cpe:2.3:h:wago:750-880:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
  • cpe:2.3:o:wago:750-881_firmware:*:*:*:*:*:*:*:* Versions up to 10 Vulnerable ·WAGO
  • cpe:2.3:h:wago:750-881:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
  • cpe:2.3:o:wago:750-852_firmware:*:*:*:*:*:*:*:* Versions up to 10 Vulnerable ·WAGO
  • cpe:2.3:h:wago:750-852:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
  • cpe:2.3:o:wago:750-882_firmware:*:*:*:*:*:*:*:* Versions up to 10 Vulnerable ·WAGO
  • cpe:2.3:h:wago:750-882:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
  • cpe:2.3:o:wago:750-885_firmware:*:*:*:*:*:*:*:* Versions up to 10 Vulnerable ·WAGO
  • cpe:2.3:h:wago:750-885:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
Show 6 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:wago:750-831_firmware:*:*:*:*:*:*:*:*up to 10VulnerableWAGO
cpe:2.3:h:wago:750-831:-:*:*:*:*:*:*:*not specified by NVDRunning onWAGO
cpe:2.3:o:wago:750-889_firmware:*:*:*:*:*:*:*:*up to 10VulnerableWAGO
cpe:2.3:h:wago:750-889:-:*:*:*:*:*:*:*not specified by NVDRunning onWAGO
cpe:2.3:o:wago:750-829_firmware:*:*:*:*:*:*:*:*up to 10VulnerableWAGO
cpe:2.3:h:wago:750-829:-:*:*:*:*:*:*:*not specified by NVDRunning onWAGO
  • cpe:2.3:o:wago:750-831_firmware:*:*:*:*:*:*:*:* Versions up to 10 Vulnerable ·WAGO
  • cpe:2.3:h:wago:750-831:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
  • cpe:2.3:o:wago:750-889_firmware:*:*:*:*:*:*:*:* Versions up to 10 Vulnerable ·WAGO
  • cpe:2.3:h:wago:750-889:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
  • cpe:2.3:o:wago:750-829_firmware:*:*:*:*:*:*:*:* Versions up to 10 Vulnerable ·WAGO
  • cpe:2.3:h:wago:750-829:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-8836
  2. 2026-10-03 Alias added: GHSA-pm5g-66xr-995q

References

Advisory 2

  • TI-2021-13604 CODESYS V2 web server: crafted requests could trigger a null pointer dereference (DoS) CVSS 3.1HIGH 7.5
  • TI-2019-07991 The Web-GUI on WAGO Series 750-88x (750-330, 750-352, 750-829, 750-831, 750-852, 750-880… CVSS 3.0CRITICAL 9.8
  • TI-2021-10729 CODESYS V2 Web-Server before 1.1.9.20 has Improper Access Control. CVSS 3.1CRITICAL 9.8
  • TI-2021-10728 CODESYS V2 Web-Server before 1.1.9.20 has a Stack-based Buffer Overflow. CVSS 3.1CRITICAL 9.8
  • TI-2021-10727 CODESYS V2 runtime system SP before 2.4.7.55 has a Stack-based Buffer Overflow. CVSS 3.1CRITICAL 9.8
  • TI-2021-13601 CODESYS V2 web server: crafted requests could trigger a heap-based buffer overflow (DoS) CVSS 3.1HIGH 7.5
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences