CVE-2021-21001: WAGO: PFC200 Access to files outside the home directory

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-05-24 · updated 2026-06-17
Weakness: CWE-22

Description

On WAGO PFC200 devices in different firmware versions with special crafted packets an authorised attacker with network access to the device can access the file system with higher privileges.

Affected products

WAGO 750-8202 Firmware: before 03.06.19_\(18\) — fixed in 03.06.19_\(18\)
WAGO 750-8203 Firmware: before 03.06.19_\(18\) — fixed in 03.06.19_\(18\)
WAGO 750-8204 Firmware: before 03.06.19_\(18\) — fixed in 03.06.19_\(18\)
WAGO 750-8206 Firmware: before 03.06.19_\(18\) — fixed in 03.06.19_\(18\)
WAGO 750-8207 Firmware: before 03.06.19_\(18\) — fixed in 03.06.19_\(18\)
WAGO 750-8208 Firmware: before 03.06.19_\(18\) — fixed in 03.06.19_\(18\)
WAGO 750-8210 Firmware: before 03.06.19_\(18\) — fixed in 03.06.19_\(18\)
WAGO 750-8211 Firmware: before 03.06.19_\(18\) — fixed in 03.06.19_\(18\)
WAGO 750-8212 Firmware: before 03.06.19_\(18\) — fixed in 03.06.19_\(18\)
WAGO 750-8213 Firmware: before 03.06.19_\(18\) — fixed in 03.06.19_\(18\)
WAGO 750-8214 Firmware: before 03.06.19_\(18\) — fixed in 03.06.19_\(18\)
WAGO 750-8216 Firmware: before 03.06.19_\(18\) — fixed in 03.06.19_\(18\)
WAGO 750-8217 Firmware: before 03.06.19_\(18\) — fixed in 03.06.19_\(18\)
WAGO 750-823 Firmware: before fw08 — fixed in fw08
WAGO 750-829 Firmware: before fw15 — fixed in fw15
WAGO 750-831 Firmware: before fw15 — fixed in fw15
WAGO 750-832 Firmware: before fw08 — fixed in fw08
WAGO 750-852 Firmware: before fw15 — fixed in fw15
WAGO 750-862 Firmware: before fw08 — fixed in fw08
WAGO 750-880 Firmware: before fw16 — fixed in fw16
WAGO 750-881 Firmware: before fw15 — fixed in fw15
WAGO 750-882 Firmware: before fw15 — fixed in fw15
WAGO 750-885 Firmware: before fw15 — fixed in fw15
WAGO 750-889 Firmware: before fw15 — fixed in fw15
WAGO 750-890 Firmware: before fw08 — fixed in fw08
WAGO 750-891 Firmware: before fw08 — fixed in fw08
WAGO 750-893 Firmware: before fw08 — fixed in fw08

How to fix

Upgrade to a fixed version: WAGO 750-8202 Firmware 03.06.19_\(18\); WAGO 750-8203 Firmware 03.06.19_\(18\); WAGO 750-8204 Firmware 03.06.19_\(18\); WAGO 750-8206 Firmware 03.06.19_\(18\); WAGO 750-8207 Firmware 03.06.19_\(18\); WAGO 750-8208 Firmware 03.06.19_\(18\); WAGO 750-8210 Firmware 03.06.19_\(18\); WAGO 750-8211 Firmware 03.06.19_\(18\); WAGO 750-8212 Firmware 03.06.19_\(18\); WAGO 750-8213 Firmware 03.06.19_\(18\); WAGO 750-8214 Firmware 03.06.19_\(18\); WAGO 750-8216 Firmware 03.06.19_\(18\). Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-21001 or the next vulnerability affects your stack