PT-2019-3493 · Beckhoff · Twincat 3.1+1

Andreas Galauner · Publicado 2019-10-07 · Atualizado 2020-02-04 · CVE-2019-5637

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions TwinCAT 2 versions prior to 2304 TwinCAT 3.1 versions prior to 4204.0

Description The issue is related to the Profinet driver in TwinCAT, which can cause a denial of service when a malformed UDP packet is sent to the device. This is also associated with division by zero errors. An attacker can exploit this issue by sending specially crafted DCP packets to cause a denial of service.

Recommendations For TwinCAT 2 versions prior to 2304, update to version 2304 or later to resolve the issue. For TwinCAT 3.1 versions prior to 4204.0, update to version 4204.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the Profinet driver to minimize the risk of exploitation.

Exploit

Correção

Divide By Zero

Enumeração de Fraquezas

CWE-369

Identificadores relacionados

BDU:2019-03668

CVE-2019-5637

Produtos afetados

Twincat 2

Twincat 3.1

Referências · 5

• 🔥 https://blog.rapid7.com/2019/10/08/r7-2019-32-denial-of-service-vulnerabilities-in-beckhoff-twincat-plc-environment-fixed · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-5637 · Nota de Segurança
• https://download.beckhoff.com/download/Document/product-security/Advisories/advisory-2019-007.pdf · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-5637 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-03668 · Nota de Segurança