HOMEVULNERABILITIESCVE-2021-30187
MEDIUM

CVE-2021-30187

CWE-78Published: May 25, 2021· Updated: Jun 17, 2026

5.3
CVSS v3.1

Official Description

CODESYS V2 runtime system SP before 2.4.7.55 has Improper Neutralization of Special Elements used in an OS Command.

NVD Source

Technical Analysis

CVE-2021-30187 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CVSS v3.1 Vector Breakdown

Exploitability
Attack VectorLocal
Attack ComplexityLow
Privileges Req.Low
User InteractionNone
ScopeUnchanged
Impact
ConfidentialityLow
IntegrityLow
AvailabilityLow
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Affected Vendors & Products

codesys1 product(s)
runtime toolkit
wago54 product(s)
750-893 firmware750-893750-891 firmware750-891750-890 firmware750-890750-889 firmware750-889750-885 firmware750-885750-882 firmware750-882+42
Source: NVD CPE · 55 total CPE entries

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time
Exploit-DB
Offensive Security exploit database
GitHub PoC Search
Community PoC repositories
Rapid7 / Metasploit
Metasploit module search
PacketStorm
Security advisories & exploits
NVD Detail
Official NIST entry
MITRE CVE
CVE Program entry
External links open in a new tab. Always verify in a controlled environment before use.

Official Patches & Advisories

ADVISORYhttps://customers.codesys.com/index.php
ADVISORYhttps://customers.codesys.com/index.php?eID=dumpFile&t=f&f=14727&token=25159b0fc4355f4c6bc2e074a519a9d0cdb23fbb&download=
ADVISORYhttps://customers.codesys.com/index.php
ADVISORYhttps://customers.codesys.com/index.php?eID=dumpFile&t=f&f=14727&token=25159b0fc4355f4c6bc2e074a519a9d0cdb23fbb&download=

News & Research Mentioning CVE-2021-30187

CODESYS in Festo Automation Suite
CISA Alerts· Mar 17, 2026

View CSAF Summary 3. TECHNICAL DETAILS The following versions of CODESYS in Festo Automation Suite are affected: FESTO Software Festo Automation Suite (versions prior to 2.8.0.138) installed with CODESYS Software CODESYS Development System (3.0) vers:all/* FESTO Software Festo Automation Suite (versions prior to 2.8.0.138) installed with CODESYS Software CODESYS Development System (3.5.16.10) vers:all/* FESTO Software Festo Automation Suite (2.8.0.137) installed with CODESYS Software CODESYS Development System (3.0) vers:all/* FESTO Software Festo Automation Suite (2.8.0.137) installed with CODESYS Software CODESYS Development System (3.5.16.10) vers:all/* CVSS Vendor Equipment Vulnerabilities v3 9.8 FESTO, CODESYS CODESYS in Festo Automation Suite D [xlite_meta score:79 src:CISA Alerts xlite_fp:17fca52d9c8a749f3ecbaf32eff92f14e856489804a56a18cc6c0d7f4acd2a9d]

All References (4)

→
https://customers.codesys.com/index.phpPermissions Required · Vendor Advisory
→
https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=14727&token=25159b0fc4355f4c6bc2e074a519a9d0cdb23fbb&download=Vendor Advisory
→
https://customers.codesys.com/index.phpPermissions Required · Vendor Advisory
→
https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=14727&token=25159b0fc4355f4c6bc2e074a519a9d0cdb23fbb&download=Vendor Advisory

Quick Facts

CVE IDCVE-2021-30187
CVSS Score5.3 / 10
SeverityMEDIUM
WeaknessCWE-78
CISA KEVNo
Affected2 vendor(s)
PublishedMay 25, 2021

Related CVEs (CWE-78)

CVE-2009-4025
10.0
CVE-2010-2445
10.0
CVE-2008-4304
10.0
CVE-2008-6554
10.0
CVE-2010-0418
10.0
CVE-2010-3754
10.0

Recommended Actions

  • →Apply vendor patches immediately
  • →Monitor CVE-2021-30187 in threat intel feeds
  • →Review IDS/IPS signatures for exploitation attempts
Data sourced from NVD (NIST), CISA KEV, and EPSS (FIRST). Analysis generated by CTIWATCH.COM. CVE data is provided under the NVD usage policy.
← All Vulnerabilities·Search for CVE-2021-30187·NVD