title: WAGO: PFC200 Denial of Service due to the number of connections to the runtime
description: On WAGO PFC200 devices in different firmware versions with special crafted packets an attacker with network access to the device could cause a denial of service for the login service of the runtime.
problem types: CWE-770 Allocation of Resources Without Limits or Throttling
affected:
{
product: Series PFC200 Controller
vendor: WAGO
versions:
lessThanOrEqual: FW07, status: affected, version: 750-823, versionType: custom
lessThanOrEqual: FW14, status: affected, version: 750-829, versionType: custom
lessThanOrEqual: FW14, status: affected, version: 750-831/000-00x, versionType: custom
lessThanOrEqual: FW06, status: affected, version: 750-832/000-00x, versionType: custom
lessThanOrEqual: FW14, status: affected, version: 750-852, versionType: custom
lessThanOrEqual: FW07, status: affected, version: 750-862, versionType: custom
lessThanOrEqual: FW15, status: affected, version: 750-880/0xx-xxx, versionType: custom
lessThanOrEqual: FW14, status: affected, version: 750-881, versionType: custom
lessThanOrEqual: FW14, status: affected, version: 750-882, versionType: custom
lessThanOrEqual: FW14, status: affected, version: 750-885/0xx-xxx, versionType: custom
lessThanOrEqual: FW14, status: affected, version: 750-889, versionType: custom
lessThanOrEqual: FW07, status: affected, version: 750-890/0xx-xxx, versionType: custom
lessThanOrEqual: FW07, status: affected, version: 750-891, versionType: custom
lessThanOrEqual: FW07, status: affected, version: 750-893, versionType: custom
}
{
product: Series Ethernet Controller
vendor: WAGO
versions:
lessThan: 03.06.19 (18), status: affected, version: 750-8202/xxx-xxx, versionType: custom
lessThan: 03.06.19 (18), status: affected, version: 750-8203/xxx-xxx, versionType: custom
lessThan: 03.06.19 (18), status: affected, version: 750-8204/xxx-xxx, versionType: custom
lessThan: 03.06.19 (18), status: affected, version: 750-8206/xxx-xxx, versionType: custom
lessThan: 03.06.19 (18), status: affected, version: 750-8207/xxx-xxx, versionType: custom
lessThan: 03.06.19 (18), status: affected, version: 750-8208/xxx-xxx, versionType: custom
lessThan: 03.06.19 (18), status: affected, version: 750-8210/xxx-xxx, versionType: custom
lessThan: 03.06.19 (18), status: affected, version: 750-8211/xxx-xxx, versionType: custom
lessThan: 03.06.19 (18), status: affected, version: 750-8212/xxx-xxx, versionType: custom
lessThan: 03.06.19 (18), status: affected, version: 750-8213/xxx-xxx, versionType: custom
lessThan: 03.06.19 (18), status: affected, version: 750-8214/xxx-xxx, versionType: custom
lessThan: 03.06.19 (18), status: affected, version: 750-8216/xxx-xxx, versionType: custom
lessThan: 03.06.19 (18), status: affected, version: 750-8217/xxx-xxx, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
]
solutions: WAGO recommends all effected users with CODESYS 2.3 Runtime PLCs to update to the firmware versions listed at https://cert.vde.com/en-us/advisories/vde-2021-014 in the solution paragraph.
workarounds: Use general security best practices to protect systems from local and network attacks.
Do not allow direct access to the device from untrusted networks.
Update to the latest firmware according to the table in chapter solutions.