PT-2020-6827 · Beckhoff · Twincat Rt

Published 2020-06-16 · Updated 2021-12-02 · CVE-2020-12494

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Beckhoff TwinCAT RT (affected versions not specified)

Description The issue is related to the disclosure of information in the TwinCAT RT network driver. It can be exploited by a remote attacker to reveal protected information. The driver's implementation of real-time features for EtherCAT functionality is affected, where Ethernet frames with payloads less than the minimum frame size are not properly padded, leading to the transmission of arbitrary memory content in the padding bytes. This can result in the disclosure of memory content, although an attacker has limited control over which content is disclosed. For example, this can be triggered by sending small-sized ICMP echo requests to the device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-459

CWE-200

Related Identifiers

BDU:2023-00077

CVE-2020-12494

Affected Products

Twincat Rt

References · 6

• https://bdu.fstec.ru/vul/2023-00077 · Security Note
• https://osv.dev/vulnerability/CVE-2020-12494 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12494 · Security Note
• https://download.beckhoff.com/download/Document/product-security/Advisories/advisory-2020-002.pdf · Note
• https://cert.vde.com/en/advisories/VDE-2020-019 · Note
• https://cert.vde.com/en-us/advisories/vde-2020-019 · Note