Summary
Critical vulnerability has been discovered in the utilized component 499ES EtherNet/IP Stack by Real Time Automation (RTA).
Details
Impact
Pepperl+Fuchs analyzed and identified affected devices.
Remote attackers may exploit the vulnerability sending specially crafted packages that may result in a denial-of-service condition or code execution.
Mitigation
An external protective measure is required.
- Minimize network exposure for affected products and ensure that they are not accessible via the Internet.
- Isolate affected products from the corporate network.
- If remote access is required, use secure methods such as virtual private networks (VPNs).
Vulnerabilities 1
-
Unscored —
Real Time Automation EtherNet/IP
499ES EtherNet/IP (ENIP) Adaptor Source Code is vulnerable to a stack-based buffer overflow, which may allow an attacker to send a specially crafted packet that may result in a denial-of-service condition or code execution.
Revision history
-
#3
Fix: added distribution
-
#2
Fixed URLs.
-
#1
Initial revision.
References
-
Pepperl+Fuchs advisory overview at CERT@VDE
https://certvde.com/de/advisories/vendor/pepperl+fuchs/
-
VDE-2020-050: Pepperl+Fuchs: Multiple Products - Vulnerability may allow remote attackers to cause a Denial Of Service - HTML
https://certvde.com/en/advisories/VDE-2020-050/