Summary
The Weidmueller Remote I/O (IP20) fieldbus couplers (u-remote) are affected by several vulnerabilities of the third-party TCP/IP Niche stack. An attacker may use crafted IP packets to cause a denial of service or breach of integrity of the affected products. Weidmueller recommends restricting network access from the internet and also locally to reduce the attack vector to a manageable minimum.
Details
Fieldbuses (including Industrial Ethernet protocols) in general are not intended for direct connection with the internet, as they lack a proper set of security capabilities. This also applies to Weidmüller IP20 Remote I/O fieldbus couplers, which are developed and designed for operation in closed industrial networks.
- Do not directly connect the affected products to the internet.
- Restrict network access to the affected products by proper secured network infrastructure (e.g. routers, firewalls, DMZ, VPNs).
- Restrict physical access to the industrial network and affected products (e.g cabinets, seals, closures).
Vulnerabilities 3
-
Unscored —
An issue was discovered in HCC Nichestack 3.0. The code that parses ICMP packets relies on an unchecked value of the IP…
-
Unscored —
An issue was discovered in HCC Nichestack 3.0. The code that parses TCP packets relies on an unchecked value of the IP …
-
Unscored —
An issue was discovered in tcp_rcv() in nptcp.c in HCC embedded InterNiche 4.0.1. The TCP header processing code doesn'…
Revision history
-
#3
Fix: added distribution
-
#2
Fix: change vendor in product tree
-
#1
Initial revision.
References
-
Weidmueller advisory overview at CERT@VDE
https://certvde.com/de/advisories/vendor/weidmueller/
-
VDE-2021-042: Weidmueller: Remote I/O fieldbus couplers (IP20) affected by INFRA:HALT vulnerabilities - HTML
https://certvde.com/en/advisories/VDE-2021-042