CVE-2021-30187
published 2021-05-25CVE-2021-30187: CODESYS V2 runtime system SP before 2.4.7.55 has Improper Neutralization of Special Elements used in an OS Command.
PriorityP426medium5.3CVSS 3.1
AVLACLPRLUINSUCLILAL
EPSS
0.27%
18.6th percentile
CODESYS V2 runtime system SP before 2.4.7.55 has Improper Neutralization of Special Elements used in an OS Command.
Affected
28 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| codesys | runtime_toolkit | < 2.4.7.55 | 2.4.7.55 |
| wago | 750-8202_firmware | < 03.06.19_\(18\) | 03.06.19_\(18\) |
| wago | 750-8203_firmware | < 03.06.19_\(18\) | 03.06.19_\(18\) |
| wago | 750-8204_firmware | < 03.06.19_\(18\) | 03.06.19_\(18\) |
| wago | 750-8206_firmware | < 03.06.19_\(18\) | 03.06.19_\(18\) |
| wago | 750-8207_firmware | < 03.06.19_\(18\) | 03.06.19_\(18\) |
| wago | 750-8208_firmware | < 03.06.19_\(18\) | 03.06.19_\(18\) |
| wago | 750-8210_firmware | < 03.06.19_\(18\) | 03.06.19_\(18\) |
| wago | 750-8211_firmware | < 03.06.19_\(18\) | 03.06.19_\(18\) |
| wago | 750-8212_firmware | < 03.06.19_\(18\) | 03.06.19_\(18\) |
| wago | 750-8213_firmware | < 03.06.19_\(18\) | 03.06.19_\(18\) |
| wago | 750-8214_firmware | < 03.06.19_\(18\) | 03.06.19_\(18\) |
| wago | 750-8216_firmware | < 03.06.19_\(18\) | 03.06.19_\(18\) |
| wago | 750-8217_firmware | < 03.06.19_\(18\) | 03.06.19_\(18\) |
| wago | 750-823_firmware | < fw08 | fw08 |
| wago | 750-829_firmware | < fw15 | fw15 |
| wago | 750-831_firmware | < fw15 | fw15 |
| wago | 750-832_firmware | < fw08 | fw08 |
| wago | 750-852_firmware | < fw15 | fw15 |
| wago | 750-862_firmware | < fw08 | fw08 |
| wago | 750-880_firmware | < fw16 | fw16 |
| wago | 750-881_firmware | < fw15 | fw15 |
| wago | 750-882_firmware | < fw15 | fw15 |
| wago | 750-885_firmware | < fw15 | fw15 |
| wago | 750-889_firmware | < fw15 | fw15 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
CODESYS in Festo Automation Suite
cisa_ics·2026-03-17
CODESYS in Festo Automation Suite
ICS Advisory
##
CODESYS in Festo Automation Suite
Release DateMarch 17, 2026
Alert CodeICSA-26-076-01
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## Summary
3. TECHNICAL DETAILS
The following versions of CODESYS in Festo Automation Suite are affected:
- FESTO Software Festo Automation Suite (versions prior to 2.8.0.138) installed with CODESYS Software CODESYS Development System (3.0) vers:all/*
- FESTO Software Festo Automation Suite (versions prior to 2.8.0.138) installed with CODESYS Software CODESYS Development System (3.5.16.10) vers:all/*
- FESTO Software Festo Automation Suite (2.8.0.137) installed with CODESYS Software CODESYS Development System (3.0) vers:all/*
- FESTO Software Festo Automation
CISA ICS
CODESYS Control V2 Linux SysFile library
cisa_ics·2021-06-22·CVSS 5.3
[MEDIUM] CODESYS Control V2 Linux SysFile library
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
CODESYS Control V2 Linux SysFile library
Last RevisedJune 22, 2021
Alert CodeICSA-21-173-04
## 1. EXECUTIVE SUMMARY
- CVSS v3 5.3
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: CODESYS, GmbH
- Equipment: CODESYS V2 Runtime Toolkit
- Vulnerability: OS Command Injection
## 2. RISK EVALUATION
Successful exploitation of this vulnerability may allow the control programmer to call additional OS functions from the PLC logic utilizing the SysFile system library.
## 3. TECHNICAL DETAILS
## 3.1 AFFECTED PRODUCTS
CODESYS reports all runtime systems for Linux bas
GHSA
GHSA-mrvh-5hf5-fwp3: CODESYS V2 runtime system SP before 2
ghsa_unreviewed·2022-05-24
CVE-2021-30187 [MEDIUM] CWE-78 GHSA-mrvh-5hf5-fwp3: CODESYS V2 runtime system SP before 2
CODESYS V2 runtime system SP before 2.4.7.55 has Improper Neutralization of Special Elements used in an OS Command.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://customers.codesys.com/index.phphttps://customers.codesys.com/index.php?eID=dumpFile&t=f&f=14727&token=25159b0fc4355f4c6bc2e074a519a9d0cdb23fbb&download=https://customers.codesys.com/index.phphttps://customers.codesys.com/index.php?eID=dumpFile&t=f&f=14727&token=25159b0fc4355f4c6bc2e074a519a9d0cdb23fbb&download=
2021-05-25
Published