PT-2021-2012 · Hirschmann · Hios+3

Published 2021-01-28 · Updated 2021-02-23 · CVE-2020-9307

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Hirschmann OS2, RSP, and RSPE devices versions prior to HiOS 08.3.00

Description The issue is related to a denial of service that can be caused by an unauthenticated, adjacent attacker, leading to an infinite loop on one of the HSR ring ports of the device. This breaks the redundancy of the HSR ring. If the attack is performed on a second device, the ring is broken into two parts, disrupting communication between devices in different parts. The vulnerability is also associated with resource release errors in the HiOS operating system.

Recommendations For Hirschmann OS2, RSP, and RSPE devices versions prior to HiOS 08.3.00, update to HiOS 08.3.00 or later to resolve the issue. As a temporary workaround, consider restricting access to the HSR ring ports to minimize the risk of exploitation.

Fix

Infinite Loop

Improper Resource Release

Weakness Enumeration

CWE-835

CWE-404

Related Identifiers

BDU:2021-00848

CVE-2020-9307

Affected Products

Hios

Hirschmann Os2

Rsp

Rspe

References · 6

• https://belden.com/dfsmedia/f1e38517e0cd4caa8b1acb6619890f5e/12276-source/options/view · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-00848 · Security Note
• https://belden.com/security · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-9307 · Security Note
• https://osv.dev/vulnerability/CVE-2020-9307 · Vendor Advisory
• https://t.me/cibsecurity/23494 · Telegram Post