Codesys

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-34584 2Codesys Wago 28750 8202 Firmware 750 8203 Firmware750 8204 Firmware+25 more Jun 17, 2026 Oct 26, 2021 N/A· v4 9.1 CRITICAL· v3 6.4 MEDIUM· v2 Crafted web server requests can be utilised to read partial stack or heap memory or may trigger a denial-of- service condition due to a crash in the CODESYS V2 web server prior to V1.1.9.22.
CVE-2021-34583 2Codesys Wago 28750 8202 Firmware 750 8203 Firmware750 8204 Firmware+25 more Jun 17, 2026 Oct 26, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Crafted web server requests may cause a heap-based buffer overflow and could therefore trigger a denial-of- service condition due to a crash in the CODESYS V2 web server prior to V1.1.9.22.
CVE-2021-21869 1Codesys 1Codesys Jun 17, 2026 Aug 25, 2021 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 An unsafe deserialization vulnerability exists in the Engine.plugin ProfileInformation ProfileData functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrar...Show more An unsafe deserialization vulnerability exists in the Engine.plugin ProfileInformation ProfileData functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.Show less
CVE-2021-21868 1Codesys 1Codesys Jun 17, 2026 Aug 18, 2021 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 An unsafe deserialization vulnerability exists in the ObjectManager.plugin Project.get_MissingTypes() functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbit...Show more An unsafe deserialization vulnerability exists in the ObjectManager.plugin Project.get_MissingTypes() functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.Show less
CVE-2021-21867 1Codesys 1Codesys Jun 17, 2026 Aug 18, 2021 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 An unsafe deserialization vulnerability exists in the ObjectManager.plugin ObjectStream.ProfileByteArray functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to ar...Show more An unsafe deserialization vulnerability exists in the ObjectManager.plugin ObjectStream.ProfileByteArray functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.Show less
CVE-2021-21863 1Codesys 1Development System Jun 17, 2026 Aug 5, 2021 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 A unsafe deserialization vulnerability exists in the ComponentModel Profile.FromFile() functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command ex...Show more A unsafe deserialization vulnerability exists in the ComponentModel Profile.FromFile() functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.Show less
CVE-2021-36765 1Codesys 1Ethernetip Jun 17, 2026 Aug 4, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In CODESYS EtherNetIP before 4.1.0.0, specific EtherNet/IP requests may cause a null pointer dereference in the downloaded vulnerable EtherNet/IP stack that is executed by the CODESYS Control runtime system.
CVE-2021-36764 1Codesys 1Gateway Jun 17, 2026 Aug 4, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In CODESYS Gateway V3 before 3.5.17.10, there is a NULL Pointer Dereference. Crafted communication requests may cause a Null pointer dereference in the affected CODESYS products and may result in a denial-of-service cond...Show more In CODESYS Gateway V3 before 3.5.17.10, there is a NULL Pointer Dereference. Crafted communication requests may cause a Null pointer dereference in the affected CODESYS products and may result in a denial-of-service condition.Show less
CVE-2021-36763 1Codesys 7Control Control RteControl Runtime System Toolkit+4 more Jun 17, 2026 Aug 3, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In CODESYS V3 web server before 3.5.17.10, files or directories are accessible to External Parties.
CVE-2021-33486 1Codesys 1Runtime Toolkit Jun 17, 2026 Aug 3, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 All versions of the CODESYS V3 Runtime Toolkit for VxWorks from version V3.5.8.0 and before version V3.5.17.10 have Improper Handling of Exceptional Conditions.
CVE-2021-33485 1Codesys 7Control Control RteControl Runtime System Toolkit+4 more Jun 17, 2026 Aug 3, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 CODESYS Control Runtime system before 3.5.17.10 has a Heap-based Buffer Overflow.
CVE-2021-21866 1Codesys 1Development System Jun 17, 2026 Aug 2, 2021 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 A unsafe deserialization vulnerability exists in the ObjectManager.plugin ProfileInformation.ProfileData functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to ar...Show more A unsafe deserialization vulnerability exists in the ObjectManager.plugin ProfileInformation.ProfileData functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.Show less
CVE-2021-21865 1Codesys 1Development System Jun 17, 2026 Aug 2, 2021 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 A unsafe deserialization vulnerability exists in the PackageManagement.plugin ExtensionMethods.Clone() functionality of CODESYS GmbH CODESYS Development System 3.5.16. A specially crafted file can lead to arbitrary comma...Show more A unsafe deserialization vulnerability exists in the PackageManagement.plugin ExtensionMethods.Clone() functionality of CODESYS GmbH CODESYS Development System 3.5.16. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.Show less
CVE-2021-21864 1Codesys 1Development System Jun 17, 2026 Aug 2, 2021 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 A unsafe deserialization vulnerability exists in the ComponentModel ComponentManager.StartupCultureSettings functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to...Show more A unsafe deserialization vulnerability exists in the ComponentModel ComponentManager.StartupCultureSettings functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.Show less
CVE-2021-30195 2Codesys Wago 29750 8202 Firmware 750 8203 Firmware750 8204 Firmware+26 more Jun 17, 2026 May 25, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 CODESYS V2 runtime system before 2.4.7.55 has Improper Input Validation.
CVE-2021-30194 2Codesys Wago 28750 8202 Firmware 750 8203 Firmware750 8204 Firmware+25 more Jun 17, 2026 May 25, 2021 N/A· v4 9.1 CRITICAL· v3 6.4 MEDIUM· v2 CODESYS V2 Web-Server before 1.1.9.20 has an Out-of-bounds Read.
CVE-2021-30193 2Codesys Wago 28750 8202 Firmware 750 8203 Firmware750 8204 Firmware+25 more Jun 17, 2026 May 25, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 CODESYS V2 Web-Server before 1.1.9.20 has an Out-of-bounds Write.
CVE-2021-30192 2Codesys Wago 28750 8202 Firmware 750 8203 Firmware750 8204 Firmware+25 more Jun 17, 2026 May 25, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 CODESYS V2 Web-Server before 1.1.9.20 has an Improperly Implemented Security Check.
CVE-2021-30191 2Codesys Wago 28750 8202 Firmware 750 8203 Firmware750 8204 Firmware+25 more Jun 17, 2026 May 25, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 CODESYS V2 Web-Server before 1.1.9.20 has a a Buffer Copy without Checking the Size of the Input.
CVE-2021-30190 2Codesys Wago 28750 8202 Firmware 750 8203 Firmware750 8204 Firmware+25 more Jun 17, 2026 May 25, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 CODESYS V2 Web-Server before 1.1.9.20 has Improper Access Control.

Previous 1 2 3 456 7 Next