CVE-2021-34566: WAGO I/O-Check Service prone to Memory Overflow

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-11-09 · updated 2026-06-17
Weakness: CWE-120

Description

In WAGO I/O-Check Service in multiple products an unauthenticated remote attacker can send a specially crafted packet containing OS commands to crash the iocheck process and write memory resulting in loss of integrity and DoS.

Affected products

WAGO 750-8100 Firmware: before 18; 18, 18-patch_1, 18-patch_2 — fixed in 18
WAGO 750-8101/025-000 Firmware: before 18; 18, 18-patch_1, 18-patch_2 — fixed in 18
WAGO 750-8101 Firmware: before 18; 18, 18-patch_1, 18-patch_2 — fixed in 18
WAGO 750-8102/025-000 Firmware: before 18; 18, 18-patch_1, 18-patch_2 — fixed in 18
WAGO 750-8102 Firmware: before 18; 18, 18-patch_1, 18-patch_2 — fixed in 18
WAGO 750-8202/000-011 Firmware: before 18; 18, 18-patch_1, 18-patch_2 — fixed in 18
WAGO 750-8202/000-012 Firmware: before 18; 18, 18-patch_1, 18-patch_2 — fixed in 18
WAGO 750-8202/000-022 Firmware: before 18; 18, 18-patch_1, 18-patch_2 — fixed in 18
WAGO 750-8202/025-000 Firmware: before 18; 18, 18-patch_1, 18-patch_2 — fixed in 18
WAGO 750-8202/025-001 Firmware: before 18; 18, 18-patch_1, 18-patch_2 — fixed in 18
WAGO 750-8202/025-002 Firmware: before 18; 18, 18-patch_1, 18-patch_2 — fixed in 18
WAGO 750-8202/040-000 Firmware: before 18; 18, 18-patch_1, 18-patch_2 — fixed in 18
WAGO 750-8202/040-001 Firmware: before 18; 18, 18-patch_1, 18-patch_2 — fixed in 18
WAGO 750-8202 Firmware: before 18; 18, 18-patch_1, 18-patch_2 — fixed in 18
WAGO 752-8303/8000-002 Firmware: before 18; 18, 18-patch_1, 18-patch_2 — fixed in 18
WAGO 762-4101 Firmware: before 18; 18, 18-patch_1, 18-patch_2 — fixed in 18
WAGO 762-4102 Firmware: before 18; 18, 18-patch_1, 18-patch_2 — fixed in 18
WAGO 762-4103 Firmware: before 18; 18, 18-patch_1, 18-patch_2 — fixed in 18
WAGO 762-4104 Firmware: before 18; 18, 18-patch_1, 18-patch_2 — fixed in 18
WAGO 762-4201/8000-001 Firmware: before 18; 18, 18-patch_1, 18-patch_2 — fixed in 18
WAGO 762-4202/8000-001 Firmware: before 18; 18, 18-patch_1, 18-patch_2 — fixed in 18
WAGO 762-4203/8000-001 Firmware: before 18; 18, 18-patch_1, 18-patch_2 — fixed in 18
WAGO 762-4204/8000-001 Firmware: before 18; 18, 18-patch_1, 18-patch_2 — fixed in 18
WAGO 762-4205/8000-001 Firmware: before 18; 18, 18-patch_1, 18-patch_2 — fixed in 18
WAGO 762-4205/8000-002 Firmware: before 18; 18, 18-patch_1, 18-patch_2 — fixed in 18
WAGO 762-4206/8000-001 Firmware: before 18; 18, 18-patch_1, 18-patch_2 — fixed in 18
WAGO 762-4206/8000-002 Firmware: before 18; 18, 18-patch_1, 18-patch_2 — fixed in 18
WAGO 762-4301/8000-002 Firmware: before 18; 18, 18-patch_1, 18-patch_2 — fixed in 18
WAGO 762-4302/8000-002 Firmware: before 18; 18, 18-patch_1, 18-patch_2 — fixed in 18
WAGO 762-4303/8000-002 Firmware: before 18; 18, 18-patch_1, 18-patch_2 — fixed in 18

How to fix

Upgrade to a fixed version: WAGO 750-8100 Firmware 18; WAGO 750-8101/025-000 Firmware 18; WAGO 750-8101 Firmware 18; WAGO 750-8102/025-000 Firmware 18; WAGO 750-8102 Firmware 18; WAGO 750-8202/000-011 Firmware 18; WAGO 750-8202/000-012 Firmware 18; WAGO 750-8202/000-022 Firmware 18; WAGO 750-8202/025-000 Firmware 18; WAGO 750-8202/025-001 Firmware 18; WAGO 750-8202/025-002 Firmware 18; WAGO 750-8202/040-000 Firmware 18. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-34566 or the next vulnerability affects your stack