PT-2020-15990 · Rockwell Automation · 499Es Ethernet/Ip Adaptor Source Code

Published 2020-11-24 · Updated 2020-11-30 · CVE-2020-25159

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions 499ES EtherNet/IP (ENIP) Adaptor Source Code (affected versions not specified)

Description The issue is related to a stack-based buffer overflow, which may allow an attacker to send a specially crafted packet. This could result in a denial-of-service condition or code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Stack Overflow

Weakness Enumeration

CWE-787

CWE-121

Related Identifiers

CVE-2020-25159

Affected Products

499Es Ethernet/Ip Adaptor Source Code

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-25159 · Security Note
• https://osv.dev/vulnerability/CVE-2020-25159 · Vendor Advisory
• https://us-cert.cisa.gov/ics/advisories/icsa-20-324-03 · Note
• https://t.me/cvenotify/6156 · Telegram Post
• https://t.me/cibsecurity/16816 · Telegram Post