Skip to content
OpenAdvisories
High FSA-202101 4 CVEs

Festo: Multiple vulnerabilities in Ethernet/IP Stack of SBRD-Q/SBOC-Q/SBOI-Q

Published Sep 22, 2021 · Updated Aug 26, 2025 · Revision 3

Vendor: Festo Product: SBOC-Q-R1B Product: SBOC-Q-R1B-S1 Product: SBOC-Q-R1C Product: SBOC-Q-R1C-S1 Product: SBOC-Q-R2B Product: SBOC-Q-R2B-S1 Product: SBOC-Q-R2C Product: SBOC-Q-R3B-WB Product: SBOC-Q-R3B-WB-S1 Product: SBOC-Q-R3C-WB Product: SBOC-Q-R3C-WB-S1 Product: SBOI-Q-R1B Product: SBOI-Q-R1B-S1 Product: SBOI-Q-R1C Product: SBOI-Q-R1C-S1 Product: SBOI-Q-R3B-WB Product: SBOI-Q-R3B-WB-S1 Product: SBOI-Q-R3C-WB Product: SBOI-Q-R3C-WB-S1 Product: SBRD-Q

Summary

The affected product families are cameras SBOC/SBOI and the Controller SBRD. The vulnerabilities are located within the Ethernet IP Stack from EIPStackGroup OpENer Ethernet/IP.

Details

Impact
Please consult the CVEs listed above and ICSA-21-105-02.

Mitigation
- Minimize network exposure for all control system devices and/or systems, and ensure that they are not accessible from the Internet.
- Deactivate EtherNet/IP in device settings if not used

Remediation
There is no fix planned.

Vulnerabilities 4

  • High 8.2
    CVE-2021-27478

    EIPStackGroup OpENer Ethernet/IP Incorrect Conversion between Numeric Types

    A specifically crafted packet sent by an attacker to EIPStackGroup OpENer EtherNet/IP commits and versions prior to Feb 10, 2021 may cause a denial-of-service condition.

    EIP Stack Group OpENer EtherNet/IP
  • High 7.5
    CVE-2021-27482

    EIPStackGroup OpENer Ethernet/IP Out-of-bounds Read

    A specifically crafted packet sent by an attacker to EIPStackGroup OpENer EtherNet/IP commits and versions prior to Feb 10, 2021 may allow the attacker to read arbitrary data.

    EIP Stack Group OpENer EtherNet/IP
  • High 7.5
    CVE-2021-27498

    EIPStackGroup OpENer Ethernet/IP Reachable Assertion

    A specifically crafted packet sent by an attacker to EIPStackGroup OpENer EtherNet/IP commits and versions prior to Feb 10, 2021 may result in a denial-of-service condition.

    EIP Stack Group OpENer EtherNet/IP
  • High 7.5
    CVE-2021-27500

    EIPStackGroup OpENer Ethernet/IP Reachable Assertion

    A specifically crafted packet sent by an attacker to EIPStackGroup OpENer EtherNet/IP commits and versions prior to Feb 10, 2021 may result in a denial-of-service condition.

    EIP Stack Group OpENer EtherNet/IP

Revision history

  1. #1.0.2

    Adjusted to VDE template. Changed document title from 'Vulnerability in Ethernet/IP Stack of SBRD-Q/SBOC-Q/SBOI-Q' to 'Festo: Multiple vulnerabilities in Ethernet/IP Stack of SBRD-Q/SBOC-Q/SBOI-Q'. Updated legal disclaimer to add references to special provisions.". Updated vulnerability notes and mitigation information. Updated legal disclaimer to add references to special provisions.

  2. #1.0.1

    Adjust link to VDE Advisory

  3. #1.0.0

    Initial revision.

References