Skip to content
OpenAdvisories
High VDE-2021-018 4 CVEs

Pepperl+Fuchs: Multiple vulnerabilites in ICE1 Ethernet IO Modules

Published May 12, 2021 · Updated May 12, 2021

Vendor: Pepperl+Fuchs Product: ICE1-16DI-G60L-V1D Product: ICE1-16DIO-G60L-C1-V1D Product: ICE1-16DIO-G60L-V1D Product: ICE1-8DI8DO-G60L-C1-V1D Product: ICE1-8DI8DO-G60L-V1D Product: ICE1-8IOL-G30L-V1D Product: ICE1-8IOL-G60L-V1D Product: ICE1-8IOL-S2-G60L-V1D

Summary

Critical vulnerability has been discovered in the utilized components rcX, mbedTLS, PROFINET IO Device and EtherNet/IP Core by Hilscher Gesellschaft für Systemautomation mbH.
The impact of the vulnerabilities on the affected device is that it can result in:
* Denial of Service (DoS)
* Remote Code Execution (RCE)
* Code Exposure

**Note:**
ICE1-8IOL-S2-G60L-V1D (70103603) is not affected by CVE-2021-20986

Details

Impact
Pepperl+Fuchs analyzed and identified affected devices.
Remote attackers may exploit the vulnerability sending specially crafted packages that may result in a denial-of-service condition or code execution.

Mitigation
An external protective measure is required. Minimize network exposure for affected products and ensure that they are not accessible via the Internet.
Isolate affected products from the corporate network. If remote access is required, use secure methods such as virtual private networks (VPNs).

Vulnerabilities 4

  • High 8.6
    CVE-2021-20987

    Hilscher: EtherNet/IP stack crash for specific CIP service

    A denial of service and memory corruption vulnerability was found in Hilscher EtherNet/IP Core V2 prior to V2.13.0.21that may lead to code injection through network or make devices crash without recovery.

    Pepper+Fuchs Hilscher WCS PCV/PXV/PGV
  • High 8.6
    CVE-2021-20988

    Hilscher rcX RTOS: Wrong handling of the UDP checksum

    In Hilscher rcX RTOS versions prios to V2.1.14.1 the actual UDP packet length is not verified against the length indicated by the packet. This may lead to a denial of service of the affected device.

    Pepperl+Fuchs Hilscher Ethernet IO Modules ICE1-16 rcX RTOS
  • High 7.5
    CVE-2021-20986

    Hilscher: Denial of Service vulnerability in PROFINET IO Device

    A Denial of Service vulnerability was found in Hilscher PROFINET IO Device V3 in versions prior to V3.14.0.7. This may lead to unexpected loss of cyclic communication or interruption of acyclic communication.

    Pepper+Fuchs Hilscher WCS PCV/PXV/PGV
  • Unscored —
    CVE-2019-18222

    The ECDSA signature implementation in ecdsa.c in Arm Mbed Crypto 2.1 and Mbed TLS through 2.19.1 does not reduce the bl…

    mbedtls mbedtls mbedtls mbedtls3 Debian Ubuntu Alpine

Revision history

  1. #1

    Initial revision.

References