CVE-2021-21000 WAGO: PFC200 Denial of Service due to the number of connections to the runtime
An attacker with network access can cause a denial of service on the login service of WAGO PFC200 controllers by sending specially crafted packets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-21000?
CVE-2021-21000 is a medium-severity denial of service vulnerability in WAGO Series Ethernet Controller, published on 24 May 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
On WAGO PFC200 devices in different firmware versions with special crafted packets an attacker with network access to the device could cause a denial of service for the login service of the runtime.
Weakness: CWE-770
Which versions are affected by CVE-2021-21000?
It affects 27 products.
Products include Wago 750-8202 Firmware, Wago 750-8203 Firmware, Wago 750-8204 Firmware, Wago 750-8206 Firmware, Wago 750-8207 Firmware, Wago 750-8208 Firmware and 21 more.
How do I fix CVE-2021-21000?
No fix has been published for CVE-2021-21000 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-21000 being exploited?
There is no known exploitation of CVE-2021-21000 in the wild and no public exploit code.
Other vulnerabilities in WAGO Series Ethernet Controller
Sources
Also known as GHSA-2ffw-fg59-p3gv.