PT-2020-6886 · Triangle Microworks · Dnp3 Outstation Libraries

Chris Anastasio + 1 · Published 2020-04-15 · Updated 2020-04-22 · CVE-2020-6996

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Triangle MicroWorks DNP3 Outstation Libraries versions 3.16.00 through 3.25.01

Description The issue is related to a stack-based buffer overflow that can be triggered by a specially crafted message. This can be exploited without requiring authentication, potentially leading to a denial of service. The vulnerability is associated with a buffer overflow in memory, which a remote attacker could exploit.

Recommendations For versions 3.16.00 through 3.25.01, update to a version that fixes the stack-based buffer overflow issue to prevent potential exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Stack Overflow

Weakness Enumeration

CWE-787

CWE-121

Related Identifiers

BDU:2023-03432

CVE-2020-6996

Affected Products

Dnp3 Outstation Libraries

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2020-6996 · Security Note
• https://bdu.fstec.ru/vul/2023-03432 · Security Note
• https://osv.dev/vulnerability/CVE-2020-6996 · Vendor Advisory
• https://us-cert.gov/ics/advisories/icsa-20-105-02 · Note
• https://securitylab.ru/vulnerability/506694.php · Note
• https://cisa.gov/news-events/ics-advisories/icsa-20-105-02 · Note
• https://se.com/ww/en/work/support/cybersecurity/security-notifications.jsp · Note