Summary
Critical vulnerability has been discovered in the utilized components rcX, mbedTLS, PROFINET IO Device and EtherNet/IP Core by Hilscher Gesellschaft für Systemautomation mbH.
The impact of the vulnerabilities on the affected device is that it can result in:
* Denial of Service (DoS)
* Remote Code Execution (RCE)
* Code Exposure
Note:
ICE1-8IOL-S2-G60L-V1D (70103603) is not affected by CVE-2021-20986
Impact
Pepperl+Fuchs analyzed and identified affected devices.
Remote attackers may exploit the vulnerability sending specially crafted packages that may result in a denial-of-service condition or code execution.
Affected Product(s)
| Model no. | Product name | Affected versions |
|---|---|---|
| Hardware ICE1-16DI-G60L-V1D <=F10017 | Hardware ICE1-16DI-G60L-V1D <=F10017 | |
| Hardware ICE1-16DIO-G60L-C1-V1D <=F10017 | Hardware ICE1-16DIO-G60L-C1-V1D <=F10017 | |
| Hardware ICE1-16DIO-G60L-V1D <=F10017 | Hardware ICE1-16DIO-G60L-V1D <=F10017 | |
| Hardware ICE1-8DI8DO-G60L-C1-V1D <=F10017 | Hardware ICE1-8DI8DO-G60L-C1-V1D <=F10017 | |
| Hardware ICE1-8DI8DO-G60L-V1D <=F10017 | Hardware ICE1-8DI8DO-G60L-V1D <=F10017 | |
| Hardware ICE1-8IOL-G30L-V1D <=F10017 | Hardware ICE1-8IOL-G30L-V1D <=F10017 | |
| Hardware ICE1-8IOL-G60L-V1D <=F10017 | Hardware ICE1-8IOL-G60L-V1D <=F10017 | |
| Hardware ICE1-8IOL-S2-G60L-V1D <=F10017 | Hardware ICE1-8IOL-S2-G60L-V1D <=F10017 |
Vulnerabilities
Expand / Collapse allIn Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of hard-coded credentials to gain full access to the device.
A Denial of Service vulnerability was found in Hilscher PROFINET IO Device V3 in versions prior to V3.14.0.7. This may lead to unexpected loss of cyclic communication or interruption of acyclic communication.
In Hilscher rcX RTOS versions prios to V2.1.14.1 the actual UDP packet length is not verified against the length indicated by the packet. This may lead to a denial of service of the affected device.
The ECDSA signature implementation in ecdsa.c in Arm Mbed Crypto 2.1 and Mbed TLS through 2.19.1 does not reduce the blinded scalar before computing the inverse, which allows a local attacker to recover the private key via side-channel attacks.
Mitigation
An external protective measure is required. Minimize network exposure for affected products and ensure that they are not accessible via the Internet.
Isolate affected products from the corporate network. If remote access is required, use secure methods such as virtual private networks (VPNs).
Revision History
| Version | Date | Summary |
|---|---|---|
| 1 | 05/12/2021 10:57 | Initial revision. |