CVE-2021-34596
CODESYS V2 runtime: Access of Uninitialized Pointer may result in denial-of-service
MEDIUM
6.5
CVSS Score
Published: October 26, 2021 at 09:55 AM UTC
Updated: June 17, 2026 at 03:56 AM UTC
49 products affected across 2 vendorsRuntime Toolkit750-880750-881
Using CODESYS V2 by CODESYS?
Get instant alerts when new vulnerabilities affect CODESYS V2 - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM6.5
Exploit prediction
EPSS 0.8%
Description
A crafted request may cause a read access to an uninitialized pointer in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56, resulting in a denial-of-service condition.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
v < 1.1.9.22PLCWinNT ≤ v < V2.4.7.56Runtime Toolkit 32 bit full ≤ v < V2.4.7.56PLCWinNTRuntime Toolkit 32 bit full
Affected range stops below 1.1.9.22, so it looks safe — our inference, not a vendor statement
Affected range stops below V2.4.7.56, so it looks safe — our inference, not a vendor statement
v < 2.4.7.56
Affected range stops below 2.4.7.56, so it looks safe — our inference, not a vendor statement
v < 2.4.7.56
Affected range stops below 2.4.7.56, so it looks safe — our inference, not a vendor statement
v < fw20
Affected range stops below fw20, so it looks safe — our inference, not a vendor statement
wago-750-8202 (same device)
v < fw20
Affected range stops below fw20, so it looks safe — our inference, not a vendor statement
wago-750-8203 (same device)
v < fw20
Affected range stops below fw20, so it looks safe — our inference, not a vendor statement
wago-750-8204 (same device)
v < fw20
Affected range stops below fw20, so it looks safe — our inference, not a vendor statement
wago-750-8206 (same device)
v < fw20
Affected range stops below fw20, so it looks safe — our inference, not a vendor statement
wago-750-8207 (same device)
v < fw20
Affected range stops below fw20, so it looks safe — our inference, not a vendor statement
wago-750-8208 (same device)
v < fw20
Affected range stops below fw20, so it looks safe — our inference, not a vendor statement
wago-750-8210 (same device)
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
References (1)
x_refsource_CONFIRMVendor Advisory
Source: [email protected]
https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=16878&token=e5644ec405590e66aefa62304cb8632df9fc9e9c&download=CVSS
6.5MEDIUMCERTVDE
- Attack Vector
- NETWORK
- Complexity
- LOW
- Privileges
- LOW
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality
- NONE
- Integrity
- NONE
- Availability
- HIGH
Vector?
Quick Info
StatusANALYZED
CWE
CWE-824
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card