PT-2020-6801 · Hirschmann Automation Control · Hisecos+1

Published 2020-02-14 · Updated 2021-06-17 · CVE-2020-6994

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hirschmann Automation and Control HiOS versions 07.0.02 and lower Hirschmann Automation and Control HiSecOS versions 03.2.00 and lower

Description A buffer overflow vulnerability was found in some devices of Hirschmann Automation and Control HiOS and HiSecOS due to improper parsing of URL arguments. An attacker could exploit this vulnerability by specially crafting HTTP requests to overflow an internal buffer.

Recommendations For HiOS versions 07.0.02 and lower, consider disabling the HTTP request parsing functionality until a patch is available. For HiSecOS versions 03.2.00 and lower, restrict access to the vulnerable module to minimize the risk of exploitation. As a temporary workaround, avoid using the vulnerable URL parameters in the affected HTTP requests until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-12

CWE-120

Related Identifiers

BDU:2022-06731

CVE-2020-6994

Affected Products

Hios

Hisecos

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2020-6994 · Security Note
• https://bdu.fstec.ru/vul/2022-06731 · Security Note
• https://osv.dev/vulnerability/CVE-2020-6994 · Vendor Advisory
• https://us-cert.gov/ics/advisories/icsa-20-091-01 · Note
• https://cisa.gov/uscert/ics/advisories/icsa-20-091-01 · Note
• https://belden.com/hubfs/support/security/bulletins/Belden_Security_Bulletin_BSECV-2020-01_1v2_FINAL.pdf · Note
• https://securitylab.ru/vulnerability/506444.php · Note
• https://t.me/cvenotify/2411 · Telegram Post