PT-2020-13157 · Phoenix Contact · Btp 2070W+2

Richard Thomas + 1 · Published 2020-12-02 · Updated 2020-12-04 · CVE-2020-12524

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Phoenix Contact HMIs BTP 2043W, BTP 2070W, and BTP 2102W versions all

Description Uncontrolled Resource Consumption can be exploited to cause the devices to become unresponsive and not accurately update the display content, resulting in a Denial of Service.

Recommendations For all versions, consider implementing measures to limit resource consumption to prevent the devices from becoming unresponsive. As a temporary workaround, restrict access to the devices until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2020-12524

Affected Products

Btp 2043W

Btp 2070W

Btp 2102W

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-12524 · Security Note
• https://t.me/cvenotify/6616 · Telegram Post
• https://t.me/cibsecurity/17033 · Telegram Post
• https://cert.vde.com/en-us/advisories/vde-2020-047 · Note
• https://t.me/cvenotify/6450 · Telegram Post