Lucene search

Rapid7CVE-2019-5637

HistoryNov 21, 2019 - 8:15 p.m.

CVE-2019-5637

2019-11-2120:15:15

CWE-369

rapid7

web.nvd.nist.gov

beckhoff

twincat

profinet

driver

denial of service

udp

nvd

cve-2019-5637

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.4

Confidence

High

EPSS

0.001

Percentile

46.4%

JSON

When Beckhoff TwinCAT is configured to use the Profinet driver, a denial of service of the controller could be reached by sending a malformed UDP packet to the device. This issue affects TwinCAT 2 version 2304 (and prior) and TwinCAT 3.1 version 4204.0 (and prior).

Affected configurations

Nvd

Node

beckhofftwincatMatch3.1.4022.30

AND

beckhofftwincat_cx2030Match-

beckhofftwincat_cx5140Match-

Node

beckhofftwincatMatch3.1.4022.29

AND

beckhofftwincat_cx5140Match-

VendorProductVersionCPE
beckhofftwincat3.1.4022.30cpe:2.3:o:beckhoff:twincat:3.1.4022.30:*:*:*:*:*:*:*
beckhofftwincat_cx2030-cpe:2.3:h:beckhoff:twincat_cx2030:-:*:*:*:*:*:*:*
beckhofftwincat_cx5140-cpe:2.3:h:beckhoff:twincat_cx5140:-:*:*:*:*:*:*:*
beckhofftwincat3.1.4022.29cpe:2.3:o:beckhoff:twincat:3.1.4022.29:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
beckhoff	twincat	3.1.4022.30	cpe:2.3:o:beckhoff:twincat:3.1.4022.30:::::::*
beckhoff	twincat_cx2030	-	cpe:2.3:h:beckhoff:twincat_cx2030:-:::::::*
beckhoff	twincat_cx5140	-	cpe:2.3:h:beckhoff:twincat_cx5140:-:::::::*
beckhoff	twincat	3.1.4022.29	cpe:2.3:o:beckhoff:twincat:3.1.4022.29:::::::*

CNA Affected

[
  {
    "product": "TwinCAT 2",
    "vendor": "Beckhoff",
    "versions": [
      {
        "lessThanOrEqual": "2304",
        "status": "affected",
        "version": "2304",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "TwinCAT 3.1",
    "vendor": "Beckhoff",
    "versions": [
      {
        "lessThanOrEqual": "4204.0",
        "status": "affected",
        "version": "4204.0",
        "versionType": "custom"
      }
    ]
  }
]

References

blog.rapid7.com/2019/10/08/r7-2019-32-denial-of-service-vulnerabilities-in-beckhoff-twincat-plc-environment-fixed/

download.beckhoff.com/download/Document/product-security/Advisories/advisory-2019-007.pdf

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.4

Confidence

High

EPSS

0.001

Percentile

46.4%

JSON

Related for CVE-2019-5637