Back to overview

Pepperl+Fuchs: Multiple Products - Vulnerability may allow remote attackers to cause a Denial Of Service

VDE-2020-050
Last update
05/14/2025 15:00
Published at
02/15/2021 14:33
Vendor(s)
Pepperl+Fuchs SE
External ID
VDE-2020-050
CSAF Document
Download

Summary

Critical vulnerability has been discovered in the utilized component 499ES EtherNet/IP Stack by Real Time Automation (RTA).

Impact

Pepperl+Fuchs analyzed and identified affected devices.
Remote attackers may exploit the vulnerability sending specially crafted packages that may result in a denial-of-service condition or code execution.

Affected Product(s)

Model no. Product name Affected versions
IC-KP-B17-AIDA1 Firmware <=18-31785F
IC-KP2-1HB17-2V1D Firmware <=18-31766H
IC-KP2-2HB17-2V1D Firmware <=18-31440H

Vulnerabilities

Expand / Collapse all

Published
09/02/2026 14:29
Vulnerability characterization
9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
This advisory characterizes the vulnerability differently from the official CVE record. For full details, please see the CSAF document.
Weakness
Stack-based Buffer Overflow (CWE-121)
Summary

499ES EtherNet/IP (ENIP) Adaptor Source Code is vulnerable to a stack-based buffer overflow, which may allow an attacker to send a specially crafted packet that may result in a denial-of-service condition or code execution.

References
cve.org | nvd.nist.gov

Mitigation

An external protective measure is required.

  • Minimize network exposure for affected products and ensure that they are not accessible via the Internet.
  • Isolate affected products from the corporate network.
  • If remote access is required, use secure methods such as virtual private networks (VPNs).

Acknowledgments

Pepperl+Fuchs SE thanks the following parties for their efforts:

  • CERT@VDE for coordination (see https://certvde.com )
  • Sharon Brizinov from Claroty for reporting this vulnerability

Revision History

Version Date Summary
1 02/15/2021 14:33 Initial revision.
2 04/10/2025 15:00 Fixed URLs.
3 05/14/2025 15:00 Fix: added distribution