PT-2020-18913 · Allen Bradley · Allen-Bradley Flex Io 1794-Aent/B

Published 2020-10-19 · Updated 2022-07-29 · CVE-2020-6085

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Allen-Bradley Flex IO 1794-AENT/B version 4.003

Description A denial of service issue exists in the ENIP Request Path Logical Segment functionality. This can be triggered by a specially crafted network request, specifically by sending an Electronic Key Segment with less than 0x18 bytes following the Key Format field, causing a loss of communications with the device.

Recommendations For Allen-Bradley Flex IO 1794-AENT/B version 4.003, as a temporary workaround, consider restricting access to the ENIP Request Path Logical Segment functionality until a patch is available. Avoid processing Electronic Key Segments with less than 0x18 bytes following the Key Format field to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2020-6085

Affected Products

Allen-Bradley Flex Io 1794-Aent/B

References · 3

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2020-1006 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-6085 · Security Note
• https://osv.dev/vulnerability/CVE-2020-6085 · Vendor Advisory