WAGO: PFC200 Access to files outside the home directory
Priority MEDIUM 42CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
On WAGO PFC200 devices in different firmware versions with special crafted packets an authorised attacker with network access to the device can access the file system with higher privileges.
Why it matters now
EPSS 0.01134 66th percentileScored 2026-11-07
Fix Fixed Series Ethernet Controller (WAGO): 03.06.19 (18)
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| WAGO | Series PFC200 Controller | 750-823 – FW07; 750-829 – FW14; 750-831/000-00x – FW14; 750-832/000-00x – FW06; 750-852 – FW14; 750-862 – FW07; 750-880/0xx-xxx – FW15; 750-881 – FW14; 750-882 – FW14; 750-885/0xx-xxx – FW14; 750-889 – FW14; 750-890/0xx-xxx – FW07; 750-891 – FW07; 750-893 – FW07 | — | No fix listed | CNA |
| WAGO | Series Ethernet Controller | 750-8202/xxx-xxx to before 03.06.19 (18); 750-8203/xxx-xxx to before 03.06.19 (18); 750-8204/xxx-xxx to before 03.06.19 (18); 750-8206/xxx-xxx to before 03.06.19 (18); 750-8207/xxx-xxx to before 03.06.19 (18); 750-8208/xxx-xxx to before 03.06.19 (18); 750-8210/xxx-xxx to before 03.06.19 (18); 750-8211/xxx-xxx to before 03.06.19 (18); 750-8212/xxx-xxx to before 03.06.19 (18); 750-8213/xxx-xxx to before 03.06.19 (18); 750-8214/xxx-xxx to before 03.06.19 (18); 750-8216/xxx-xxx to before 03.06.19 (18); 750-8217/xxx-xxx to before 03.06.19 (18) | 03.06.19 (18) | Patch available | CNA |
- Series PFC200 Controller VendorWAGO Affected 750-823 – FW07; 750-829 – FW14; 750-831/000-00x – FW14; 750-832/000-00x – FW06; 750-852 – FW14; 750-862 – FW07; 750-880/0xx-xxx – FW15; 750-881 – FW14; 750-882 – FW14; 750-885/0xx-xxx – FW14; 750-889 – FW14; 750-890/0xx-xxx – FW07; 750-891 – FW07; 750-893 – FW07 Fixed in — No fix listed CNA
- Series Ethernet Controller VendorWAGO Affected 750-8202/xxx-xxx to before 03.06.19 (18); 750-8203/xxx-xxx to before 03.06.19 (18); 750-8204/xxx-xxx to before 03.06.19 (18); 750-8206/xxx-xxx to before 03.06.19 (18); 750-8207/xxx-xxx to before 03.06.19 (18); 750-8208/xxx-xxx to before 03.06.19 (18); 750-8210/xxx-xxx to before 03.06.19 (18); 750-8211/xxx-xxx to before 03.06.19 (18); 750-8212/xxx-xxx to before 03.06.19 (18); 750-8213/xxx-xxx to before 03.06.19 (18); 750-8214/xxx-xxx to before 03.06.19 (18); 750-8216/xxx-xxx to before 03.06.19 (18); 750-8217/xxx-xxx to before 03.06.19 (18) Fixed in 03.06.19 (18) Patch available CNA
CPE configurations NVD · 54
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:wago:750-823_firmware:*:*:*:*:*:*:*:* | before fw08 | Vulnerable | WAGO |
| cpe:2.3:h:wago:750-823:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:750-829_firmware:*:*:*:*:*:*:*:* | before fw15 | Vulnerable | WAGO |
| cpe:2.3:h:wago:750-829:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:750-831_firmware:*:*:*:*:*:*:*:* | before fw15 | Vulnerable | WAGO |
| cpe:2.3:h:wago:750-831:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:750-832_firmware:*:*:*:*:*:*:*:* | before fw08 | Vulnerable | WAGO |
| cpe:2.3:h:wago:750-832:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:750-852_firmware:*:*:*:*:*:*:*:* | before fw15 | Vulnerable | WAGO |
| cpe:2.3:h:wago:750-852:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
- cpe:2.3:o:wago:750-823_firmware:*:*:*:*:*:*:*:* Versions before fw08 Vulnerable ·WAGO
- cpe:2.3:h:wago:750-823:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:750-829_firmware:*:*:*:*:*:*:*:* Versions before fw15 Vulnerable ·WAGO
- cpe:2.3:h:wago:750-829:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:750-831_firmware:*:*:*:*:*:*:*:* Versions before fw15 Vulnerable ·WAGO
- cpe:2.3:h:wago:750-831:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:750-832_firmware:*:*:*:*:*:*:*:* Versions before fw08 Vulnerable ·WAGO
- cpe:2.3:h:wago:750-832:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:750-852_firmware:*:*:*:*:*:*:*:* Versions before fw15 Vulnerable ·WAGO
- cpe:2.3:h:wago:750-852:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
Show 44 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:wago:750-862_firmware:*:*:*:*:*:*:*:* | before fw08 | Vulnerable | WAGO |
| cpe:2.3:h:wago:750-862:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:750-880_firmware:*:*:*:*:*:*:*:* | before fw16 | Vulnerable | WAGO |
| cpe:2.3:h:wago:750-880:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:750-881_firmware:*:*:*:*:*:*:*:* | before fw15 | Vulnerable | WAGO |
| cpe:2.3:h:wago:750-881:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:750-882_firmware:*:*:*:*:*:*:*:* | before fw15 | Vulnerable | WAGO |
| cpe:2.3:h:wago:750-882:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:750-885_firmware:*:*:*:*:*:*:*:* | before fw15 | Vulnerable | WAGO |
| cpe:2.3:h:wago:750-885:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:750-889_firmware:*:*:*:*:*:*:*:* | before fw15 | Vulnerable | WAGO |
| cpe:2.3:h:wago:750-889:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:750-890_firmware:*:*:*:*:*:*:*:* | before fw08 | Vulnerable | WAGO |
| cpe:2.3:h:wago:750-890:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:750-891_firmware:*:*:*:*:*:*:*:* | before fw08 | Vulnerable | WAGO |
| cpe:2.3:h:wago:750-891:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:750-893_firmware:*:*:*:*:*:*:*:* | before fw08 | Vulnerable | WAGO |
| cpe:2.3:h:wago:750-893:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:750-8202_firmware:*:*:*:*:*:*:*:* | before 03.06.19_\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:750-8202:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:750-8203_firmware:*:*:*:*:*:*:*:* | before 03.06.19_\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:750-8203:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:750-8204_firmware:*:*:*:*:*:*:*:* | before 03.06.19_\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:750-8204:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:750-8206_firmware:*:*:*:*:*:*:*:* | before 03.06.19_\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:750-8206:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:750-8207_firmware:*:*:*:*:*:*:*:* | before 03.06.19_\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:750-8207:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:750-8208_firmware:*:*:*:*:*:*:*:* | before 03.06.19_\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:750-8208:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:750-8210_firmware:*:*:*:*:*:*:*:* | before 03.06.19_\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:750-8210:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:750-8211_firmware:*:*:*:*:*:*:*:* | before 03.06.19_\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:750-8211:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:750-8212_firmware:*:*:*:*:*:*:*:* | before 03.06.19_\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:750-8212:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:750-8213_firmware:*:*:*:*:*:*:*:* | before 03.06.19_\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:750-8213:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:750-8214_firmware:*:*:*:*:*:*:*:* | before 03.06.19_\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:750-8214:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:750-8216_firmware:*:*:*:*:*:*:*:* | before 03.06.19_\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:750-8216:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:750-8217_firmware:*:*:*:*:*:*:*:* | before 03.06.19_\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:750-8217:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
- cpe:2.3:o:wago:750-862_firmware:*:*:*:*:*:*:*:* Versions before fw08 Vulnerable ·WAGO
- cpe:2.3:h:wago:750-862:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:750-880_firmware:*:*:*:*:*:*:*:* Versions before fw16 Vulnerable ·WAGO
- cpe:2.3:h:wago:750-880:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:750-881_firmware:*:*:*:*:*:*:*:* Versions before fw15 Vulnerable ·WAGO
- cpe:2.3:h:wago:750-881:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:750-882_firmware:*:*:*:*:*:*:*:* Versions before fw15 Vulnerable ·WAGO
- cpe:2.3:h:wago:750-882:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:750-885_firmware:*:*:*:*:*:*:*:* Versions before fw15 Vulnerable ·WAGO
- cpe:2.3:h:wago:750-885:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:750-889_firmware:*:*:*:*:*:*:*:* Versions before fw15 Vulnerable ·WAGO
- cpe:2.3:h:wago:750-889:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:750-890_firmware:*:*:*:*:*:*:*:* Versions before fw08 Vulnerable ·WAGO
- cpe:2.3:h:wago:750-890:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:750-891_firmware:*:*:*:*:*:*:*:* Versions before fw08 Vulnerable ·WAGO
- cpe:2.3:h:wago:750-891:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:750-893_firmware:*:*:*:*:*:*:*:* Versions before fw08 Vulnerable ·WAGO
- cpe:2.3:h:wago:750-893:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:750-8202_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19_\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:750-8202:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:750-8203_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19_\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:750-8203:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:750-8204_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19_\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:750-8204:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:750-8206_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19_\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:750-8206:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:750-8207_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19_\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:750-8207:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:750-8208_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19_\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:750-8208:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:750-8210_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19_\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:750-8210:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:750-8211_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19_\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:750-8211:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:750-8212_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19_\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:750-8212:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:750-8213_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19_\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:750-8213:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:750-8214_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19_\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:750-8214:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:750-8216_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19_\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:750-8216:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:750-8217_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19_\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:750-8217:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
Remediation
- Fix · CNA Series Ethernet Controller (WAGO) Fixed in 03.06.19 (18)
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
WAGO Series Ethernet Controller 03.06.19 (18)
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2021-04106 WAGO: PFC200 Denial of Service due to the number of connections to the runtimePriority LOW 35
Timeline
- 2026-10-02 Threatist record created from CVE-2021-21001
- 2026-10-03 Alias added: GHSA-52pm-rch7-vfc5
References
More WAGO 750-8202 Firmware vulnerabilities
- TI-2021-13584 WAGO I/O-Check Service prone to Memory Overflow CVSS 3.1CRITICAL 9.1
- TI-2021-13604 CODESYS V2 web server: crafted requests could trigger a null pointer dereference (DoS) CVSS 3.1HIGH 7.5
- TI-2021-13587 WAGO I/O-Check Service prone to Out-of-bounds Write CVSS 3.1CRITICAL 9.8
- TI-2021-10729 CODESYS V2 Web-Server before 1.1.9.20 has Improper Access Control. CVSS 3.1CRITICAL 9.8
- TI-2021-10728 CODESYS V2 Web-Server before 1.1.9.20 has a Stack-based Buffer Overflow. CVSS 3.1CRITICAL 9.8
- TI-2021-10727 CODESYS V2 runtime system SP before 2.4.7.55 has a Stack-based Buffer Overflow. CVSS 3.1CRITICAL 9.8
Sources
- CVE-2021-21001 · CVE Program
- CVE-2021-21001 · NVD
- FIRST EPSS
- GHSA-52pm-rch7-vfc5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences