WAGO: PFC200 Access to files outside the home directory

9.1 CVSS

Vulnerability Description

On WAGO PFC200 devices in different firmware versions with special crafted packets an authorised attacker with network access to the device can access the file system with higher privileges.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-21001

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

These vulnerabilities were reported by JSC Positive Technologies (Vyacheslav Moskvin, Anton Dorfman, Sergey Fedonin, Ivan Kurnakov, Denis Goryushev). Coordination done by CERT@VDE.

References

https://cert.vde.com/en-us/advisories/vde-2021-014

More from WAGO

View All →

CVE-2025-41732

Stack-based buffer overflow via unsafe sscanf in check_cookie()

Critical 9.8

CVE-2025-41730

Stack-based buffer overflow via unsafe sscanf in check_account()

Critical 9.8

CVE-2025-41716

Unauthenticated User Enumeration via Missing Authentication

Medium 5.3

CVE-2025-41715

Missing Authentication for Database Access in Web Application

Critical 9.8

CVE-2025-41713

WAGO: Vulnerability in hardware switch circuit

Medium 6.5

Affected Vendor

WAGO

View all reports →

Affected Software

Series PFC200 Controller, Series Ethernet Controller

Vulnerable Versions:

750-823, 750-829, 750-831/000-00x, 750-832/000-00x, 750-852, 750-862, 750-880/0xx-xxx, 750-881, 750-882, 750-885/0xx-xxx, 750-889, 750-890/0xx-xxx, 750-891, 750-893, 750-8202/xxx-xxx, 750-8203/xxx-xxx, 750-8204/xxx-xxx, 750-8206/xxx-xxx, 750-8207/xxx-xxx, 750-8208/xxx-xxx, 750-8210/xxx-xxx, 750-8211/xxx-xxx, 750-8212/xxx-xxx, 750-8213/xxx-xxx, 750-8214/xxx-xxx, 750-8216/xxx-xxx, 750-8217/xxx-xxx