CVE-2021-29242

Name: CVE-2021-29242
Creator: NVD / NIST
Published: 2021-05-03T14:15:07.667+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 7.3/10EPSS 1.07%

Last modified Jun 17, 2026

CVE-2021-29242 is a high-severity vulnerability rated 7.3/10 on the CVSS scale. CODESYS Control Runtime system before 3.5.17.0 has improper input validation. Attackers can send crafted communication packets to change the router's addressing scheme and may re-route, add, remove or change low level communication packages.. EPSS estimates a 1.07% chance of exploitation in the next 30 days.

Description

CODESYS Control Runtime system before 3.5.17.0 has improper input validation. Attackers can send crafted communication packets to change the router's addressing scheme and may re-route, add, remove or change low level communication packages.

Metrics

CVSS 3.1

7.3/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS Probability

1.07%

60.5th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-20

Affected Software

Vendor	Product	Versions
Codesys	Control For Beaglebone Sl	>= 3.0, < 4.1.0.0
Codesys	Control For Empc-A\/Imx6 Sl	>= 3.0, < 4.1.0.0
Codesys	Control For Iot2000 Sl	>= 3.0, < 4.1.0.0
Codesys	Control For Linux Arm Sl	>= 3.0, < 4.1.0.0
Codesys	Control For Linux Sl	>= 3.0, < 4.1.0.0
Codesys	Control For Pfc100 Sl	>= 3.0, < 4.1.0.0
Codesys	Control For Pfc200 Sl	>= 3.0, < 4.1.0.0
Codesys	Control For Plcnext Sl	>= 3.0, < 4.1.0.0
Codesys	Control For Raspberry Pi Sl	>= 3.0, < 4.1.0.0
Codesys	Control For Wago Touch Panels 600 Sl	>= 3.0, < 4.1.0.0
Codesys	Control Rte	>= 3.0, < 3.5.17.0
Codesys	Control Runtime System Toolkit	>= 3.0, < 3.5.17.0
Codesys	Control Win	>= 3.0, < 3.5.17.0
Codesys	Edge Gateway	>= 3.0, < 3.5.17.0
Codesys	Edge Gateway	>= 3.0, < 4.1.0.0
Codesys	Embedded Target Visu Toolkit	>= 3.0, < 3.5.17.0
Codesys	Gateway	>= 3.0, < 3.5.17.0
Codesys	Hmi	>= 3.0, < 3.5.17.0
Codesys	Opc Server	>= 3.0, < 3.5.17.0
Codesys	Plchandler	>= 3.0, < 3.5.17.0
Codesys	Remote Target Visu Toolkit	>= 3.0, < 3.5.17.0
Codesys	Safety Sil	>= 3.0, < 3.5.17.0
Codesys	Simulation Runtime	>= 3.0, < 3.5.17.0

References

https://customers.codesys.com/index.phpPermissions Required, Vendor Advisory
https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=14640&token=623b6fceb0579ef0f7505e29beefa5b3f8ac7873&download=Vendor Advisory
https://www.codesys.com/security/security-reports.htmlVendor Advisory
https://customers.codesys.com/index.phpPermissions Required, Vendor Advisory
https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=14640&token=623b6fceb0579ef0f7505e29beefa5b3f8ac7873&download=Vendor Advisory
https://www.codesys.com/security/security-reports.htmlVendor Advisory

Timeline

Published: May 3, 2021
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2021-29242?

How severe is CVE-2021-29242?

CVE-2021-29242 has a CVSS score of 7.3/10 (HIGH severity). The EPSS model estimates a 1.07% probability of exploitation in the next 30 days.

How do I fix CVE-2021-29242?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-29242?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST