Multiple vulnerabilities in Allen-Bradley Flex IO 1794-AENT/B

Published: 2020-10-14 | Updated: 2021-02-03

Risk	Medium
Patch available	NO
Number of vulnerabilities	6
CVE-ID	CVE-2020-6083 CVE-2020-6084 CVE-2020-6085 CVE-2020-6086 CVE-2020-6087 CVE-2020-6088
CWE-ID	CWE-119
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	Flex IO 1794-AENT/B Hardware solutions / Firmware
Vendor	Rockwell Automation

Security Bulletin

This security bulletin contains information about 6 vulnerabilities.

Updated 03.02.2021
Added vulnerability #6

1) Buffer overflow

EUVDB-ID: #VU47640

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-6083

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in the ENIP Request Path Port Segment functionality. A remote attacker can send a specially crafted network request, trigger memory corruption and cause a denial of service condition on the target system.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

Flex IO 1794-AENT/B: 4.003

CPE2.3

cpe:2.3:h:rockwell_automation:flex_io_1794-aent_b:4.003:*:*:*:*:*:*:*

External links

https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1005

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Buffer overflow

EUVDB-ID: #VU47641

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-6084

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in the ENIP Request Path Logical Segment functionality. A remote attacker can send an Electronic Key Segment with less bytes than required by the Key Format Table following the Key Format field, trigger memory corruption and cause a denial of service condition on the target system.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

Flex IO 1794-AENT/B: 4.003

CPE2.3

cpe:2.3:h:rockwell_automation:flex_io_1794-aent_b:4.003:*:*:*:*:*:*:*

External links

https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1006

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Buffer overflow

EUVDB-ID: #VU47642

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-6085

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in the ENIP Request Path Logical Segment functionality. A remote attacker can send an Electronic Key Segment with less than 0x18 bytes following the Key Format field, trigger memory corruption and cause a denial of service condition on the target system.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

Flex IO 1794-AENT/B: 4.003

CPE2.3

cpe:2.3:h:rockwell_automation:flex_io_1794-aent_b:4.003:*:*:*:*:*:*:*

External links

https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1006

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Buffer overflow

EUVDB-ID: #VU47643

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-6086

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in the ENIP Request Path Data Segment functionality. A remote attacker can suply the Simple Segment Sub-Type, trigger memory corruption and cause a denial of service condition on the target system.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

Flex IO 1794-AENT/B: 4.003

CPE2.3

cpe:2.3:h:rockwell_automation:flex_io_1794-aent_b:4.003:*:*:*:*:*:*:*

External links

https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1007

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Buffer overflow

EUVDB-ID: #VU47644

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-6087

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in the ENIP Request Path Data Segment functionality. A remote attacker can suply the ANSI Extended Symbol Segment Sub-Type, trigger memory corruption and cause a denial of service condition on the target system.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

Flex IO 1794-AENT/B: 4.003

CPE2.3

cpe:2.3:h:rockwell_automation:flex_io_1794-aent_b:4.003:*:*:*:*:*:*:*

External links

https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1007

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Buffer overflow

EUVDB-ID: #VU50272

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-6088

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in the ENIP Request Path Network Segment functionality. A remote attacker can suply the ANSI Extended Symbol Segment Sub-Type, trigger memory corruption and cause a denial of service condition on the target system.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

Flex IO 1794-AENT/B: 4.003

CPE2.3

cpe:2.3:h:rockwell_automation:flex_io_1794-aent_b:4.003:*:*:*:*:*:*:*

External links

https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1008

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.