CVE-2019-5637 - OpenCVE

When Beckhoff TwinCAT is configured to use the Profinet driver, a denial of service of the controller could be reached by sending a malformed UDP packet to the device. This issue affects TwinCAT 2 version 2304 (and prior) and TwinCAT 3.1 version 4204.0 (and prior).

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

AV:N/AC:L/Au:N/C:N/I:N/A:P

Vendors & Products
CPE Configurations

Vendors	Products
Beckhoff	Twincat Cx5140 Twincat Twincat Cx2030

Configuration 1 [-]

AND

cpe:2.3:o:beckhoff:twincat:3.1.4022.30:*:*:*:*:*:*:*

OR	cpe:2.3:h:beckhoff:twincat_cx2030:-:::::::*
	cpe:2.3:h:beckhoff:twincat_cx5140:-:::::::*

Configuration 2 [-]

AND

cpe:2.3:o:beckhoff:twincat:3.1.4022.29:*:*:*:*:*:*:*

cpe:2.3:h:beckhoff:twincat_cx5140:-:*:*:*:*:*:*:*

References

Link	Resource
https://blog.rapid7.com/2019/10/08/r7-2019-32-denial-of-service-vulnerabilities-in-beckhoff-twincat-plc-environment-fixed/	Exploit Third Party Advisory
https://download.beckhoff.com/download/Document/product-security/Advisories/advisory-2019-007.pdf	Mitigation Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: rapid7

Published: 2019-10-08T00:00:00

Updated: 2020-02-04T22:58:40

Reserved: 2019-01-07T00:00:00

Link: CVE-2019-5637

JSON object: View

NVD Information

Status : Modified

Published: 2019-11-21T20:15:15.990

Modified: 2020-02-04T23:15:10.787

Link: CVE-2019-5637

JSON object: View

Redhat Information

No data.

CWE

CWE-369

{"containers": {"cna": {"affected": [{"product": "TwinCAT 2", "vendor": "Beckhoff", "versions": [{"lessThanOrEqual": "2304", "status": "affected", "version": "2304", "versionType": "custom"}]}, {"product": "TwinCAT 3.1", "vendor": "Beckhoff", "versions": [{"lessThanOrEqual": "4204.0", "status": "affected", "version": "4204.0", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "This issue was discovered, and reported to Rapid7, by Andreas Galauner at Rapid7. It is being disclosed in accordance with Rapid7's vulnerability disclosure policy (https://www.rapid7.com/disclosure/)."}], "datePublic": "2019-10-08T00:00:00", "descriptions": [{"lang": "en", "value": "When Beckhoff TwinCAT is configured to use the Profinet driver, a denial of service of the controller could be reached by sending a malformed UDP packet to the device. This issue affects TwinCAT 2 version 2304 (and prior) and TwinCAT 3.1 version 4204.0 (and prior)."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-369", "description": "CWE-369 Divide By Zero", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-02-04T22:58:40", "orgId": "9974b330-7714-4307-a722-5648477acda7", "shortName": "rapid7"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://blog.rapid7.com/2019/10/08/r7-2019-32-denial-of-service-vulnerabilities-in-beckhoff-twincat-plc-environment-fixed/"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://download.beckhoff.com/download/Document/product-security/Advisories/advisory-2019-007.pdf"}], "source": {"advisory": "R7-2019-32", "discovery": "EXTERNAL"}, "title": "Beckhoff TwinCAT Profinet Driver Divide-by-Zero Denial of Service", "x_generator": {"engine": "Vulnogram 0.0.8"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@rapid7.com", "DATE_PUBLIC": "2019-10-08T14:05:00.000Z", "ID": "CVE-2019-5637", "STATE": "PUBLIC", "TITLE": "Beckhoff TwinCAT Profinet Driver Divide-by-Zero Denial of Service"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "TwinCAT 2", "version": {"version_data": [{"version_affected": "<=", "version_name": "2304", "version_value": "2304"}]}}, {"product_name": "TwinCAT 3.1", "version": {"version_data": [{"version_affected": "<=", "version_name": "4204.0", "version_value": "4204.0"}]}}]}, "vendor_name": "Beckhoff"}]}}, "credit": [{"lang": "eng", "value": "This issue was discovered, and reported to Rapid7, by Andreas Galauner at Rapid7. It is being disclosed in accordance with Rapid7's vulnerability disclosure policy (https://www.rapid7.com/disclosure/)."}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "When Beckhoff TwinCAT is configured to use the Profinet driver, a denial of service of the controller could be reached by sending a malformed UDP packet to the device. This issue affects TwinCAT 2 version 2304 (and prior) and TwinCAT 3.1 version 4204.0 (and prior)."}]}, "generator": {"engine": "Vulnogram 0.0.8"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-369 Divide By Zero"}]}]}, "references": {"reference_data": [{"name": "https://blog.rapid7.com/2019/10/08/r7-2019-32-denial-of-service-vulnerabilities-in-beckhoff-twincat-plc-environment-fixed/", "refsource": "MISC", "url": "https://blog.rapid7.com/2019/10/08/r7-2019-32-denial-of-service-vulnerabilities-in-beckhoff-twincat-plc-environment-fixed/"}, {"name": "https://download.beckhoff.com/download/Document/product-security/Advisories/advisory-2019-007.pdf", "refsource": "CONFIRM", "url": "https://download.beckhoff.com/download/Document/product-security/Advisories/advisory-2019-007.pdf"}]}, "source": {"advisory": "R7-2019-32", "discovery": "EXTERNAL"}}}}, "cveMetadata": {"assignerOrgId": "9974b330-7714-4307-a722-5648477acda7", "assignerShortName": "rapid7", "cveId": "CVE-2019-5637", "datePublished": "2019-10-08T00:00:00", "dateReserved": "2019-01-07T00:00:00", "dateUpdated": "2020-02-04T22:58:40", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:beckhoff:twincat:3.1.4022.30:*:*:*:*:*:*:*", "matchCriteriaId": "477A520F-02A3-4D28-BBF5-C4717C070966", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:beckhoff:twincat_cx2030:-:*:*:*:*:*:*:*", "matchCriteriaId": "6A355A09-C6BE-46DC-833D-F10BB2D6D7F0", "vulnerable": false}, {"criteria": "cpe:2.3:h:beckhoff:twincat_cx5140:-:*:*:*:*:*:*:*", "matchCriteriaId": "31D140D1-8A39-4AB3-A5B4-354E5A3CE3D9", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:beckhoff:twincat:3.1.4022.29:*:*:*:*:*:*:*", "matchCriteriaId": "D25AC406-30DE-4D81-A1AE-266919204EA7", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:beckhoff:twincat_cx5140:-:*:*:*:*:*:*:*", "matchCriteriaId": "31D140D1-8A39-4AB3-A5B4-354E5A3CE3D9", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "When Beckhoff TwinCAT is configured to use the Profinet driver, a denial of service of the controller could be reached by sending a malformed UDP packet to the device. This issue affects TwinCAT 2 version 2304 (and prior) and TwinCAT 3.1 version 4204.0 (and prior)."}, {"lang": "es", "value": "Cuando Beckhoff TwinCAT est\u00e1 configurado para usar el controlador Profinet, se puede llegar a una denegaci\u00f3n de servicio del controlador enviando un paquete UDP con formato incorrecto al dispositivo. Este problema afecta a TwinCAT 2 versi\u00f3n 2304 (y anterior) y TwinCAT 3.1 versi\u00f3n 4204.0 (y anterior)."}], "id": "CVE-2019-5637", "lastModified": "2020-02-04T23:15:10.787", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "cve@rapid7.com", "type": "Secondary"}]}, "published": "2019-11-21T20:15:15.990", "references": [{"source": "cve@rapid7.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://blog.rapid7.com/2019/10/08/r7-2019-32-denial-of-service-vulnerabilities-in-beckhoff-twincat-plc-environment-fixed/"}, {"source": "cve@rapid7.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://download.beckhoff.com/download/Document/product-security/Advisories/advisory-2019-007.pdf"}], "sourceIdentifier": "cve@rapid7.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-369"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-369"}], "source": "cve@rapid7.com", "type": "Secondary"}]}