| Article No° | Product Name | Affected Version(s) |
|---|---|---|
| 1334890000 | UR20-FBC-CAN | <= 01.08.00 |
| 2625010000 | UR20-FBC-CC | <= 01.00.02 |
| 2680260000 | UR20-FBC-CC-TSN | <= 01.02.01 |
| 1334900000 | UR20-FBC-DN | <= 01.08.00 |
| 1334910000 | UR20-FBC-EC | <= 01.12.00 |
| 2659690000 | UR20-FBC-EC-ECO | <= 01.00.01 |
| 1334920000 | UR20-FBC-EIP | <= 02.11.00 |
| 2661310000 | UR20-FBC-IEC61162-450 | <= 01.01.00 |
| 2659700000 | UR20-FBC-MOD-TCP-ECO | <= 01.00.00 |
| 2476450000 | UR20-FBC-MOD-TCP-V2 | <= 02.08.01 |
| 2614380000 | UR20-FBC-PB-DP-V2 | <= 01.10.00 |
| 1334940000 | UR20-FBC-PL | <= 01.08.00 |
| 2659680000 | UR20-FBC-PN-ECO | <= 01.00.02 |
| 2566380000 | UR20-FBC-PN-IRT-V2 | <= 01.11.00 |
The Weidmueller Remote I/O (IP20) fieldbus couplers (u-remote) are affected by several vulnerabilities of the third-party TCP/IP Niche stack. An attacker may use crafted IP packets to cause a denial of service or breach of integrity of the affected products. Weidmueller recommends restricting network access from the internet and also locally to reduce the attack vector to a manageable minimum.
An issue was discovered in tcp_rcv() in nptcp.c in HCC embedded InterNiche 4.0.1. The TCP header processing code doesn't sanitize the value of the IP total length field (header length + data length). With a crafted IP packet, an integer overflow occurs whenever the value of the IP data length is calculated by subtracting the length of the header from the total length of the IP packet.
An issue was discovered in HCC Nichestack 3.0. The code that parses TCP packets relies on an unchecked value of the IP payload size (extracted from the IP header) to compute the length of the TCP payload within the TCP checksum computation function. When the IP payload size is set to be smaller than the size of the IP header, the TCP checksum computation function may read out of bounds (a low-impact write-out-of-bounds is also possible).
An issue was discovered in HCC Nichestack 3.0. The code that parses ICMP packets relies on an unchecked value of the IP payload size (extracted from the IP header) to compute the ICMP checksum. When the IP payload size is set to be smaller than the size of the IP header, the ICMP checksum computation function may read out of bounds, causing a Denial-of-Service.
Fieldbuses (including Industrial Ethernet protocols) in general are not intended for direct connection with the internet, as they lack a proper set of security capabilities. This also applies to Weidmüller IP20 Remote I/O fieldbus couplers, which are developed and designed for operation in closed industrial networks.
Remediation
These vulnerabilities were discovered and reported by Forescout Technologies, Inc.
Weidmüller thanks CERT@VDE for the coordination and support with this publication.