FKIE_CVE-2020-6994

Vulnerability from fkie_nvd - Published: 2020-04-03 19:15 - Updated: 2024-11-21 05:36
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
A buffer overflow vulnerability was found in some devices of Hirschmann Automation and Control HiOS and HiSecOS. The vulnerability is due to improper parsing of URL arguments. An attacker could exploit this vulnerability by specially crafting HTTP requests to overflow an internal buffer. The following devices using HiOS Version 07.0.02 and lower are affected: RSP, RSPE, RSPS, RSPL, MSP, EES, EES, EESX, GRS, OS, RED. The following devices using HiSecOS Version 03.2.00 and lower are affected: EAGLE20/30.
References
ics-cert@hq.dhs.govhttps://www.us-cert.gov/ics/advisories/icsa-20-091-01Mitigation, Third Party Advisory, US Government Resource
af854a3a-2127-422b-91ae-364da2661108https://www.us-cert.gov/ics/advisories/icsa-20-091-01Mitigation, Third Party Advisory, US Government Resource
Impacted products
Vendor Product Version
belden hirschmann_hios *
belden hirschmann_embedded_ethernet_switch -
belden hirschmann_embedded_ethernet_switch_extended -
belden hirschmann_greyhound_swtich -
belden hirschmann_mice_switch_power -
belden hirschmann_octopus -
belden hirschmann_prp_redbox -
belden hirschmann_rail_switch_power -
belden hirschmann_rail_switch_power_enhanced -
belden hirschmann_rail_switch_power_lite -
belden hirschmann_rail_switch_power_smart -
belden hirschmann_hisecos *
belden hirschmann_eagle20 -
belden hirschmann_eagle30 -
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:belden:hirschmann_hios:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "7B3DB8FD-EC62-46F4-B60F-F71F3177730B",
              "versionEndIncluding": "07.0.02",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:belden:hirschmann_embedded_ethernet_switch:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "3CB779E6-113B-4430-905F-427FC87A61D8",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:belden:hirschmann_embedded_ethernet_switch_extended:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E0EF2CF9-2150-4750-8DD6-9A911A187F34",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:belden:hirschmann_greyhound_swtich:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "2969C04A-B6C8-4F91-921A-5E13491329F0",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:belden:hirschmann_mice_switch_power:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "74C8EBA4-96AB-4A40-B6FD-6A7C44C1F4FF",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:belden:hirschmann_octopus:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "4F849F79-6A81-433E-AF58-B745D177837C",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:belden:hirschmann_prp_redbox:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7678F652-5260-4A81-931B-D5F2B4F91A66",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:belden:hirschmann_rail_switch_power:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "992A605B-5B55-433C-A4E5-C9725C263FB3",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:belden:hirschmann_rail_switch_power_enhanced:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "ACC46D0A-4F92-41C7-B069-5047526CDCDF",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:belden:hirschmann_rail_switch_power_lite:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "FDE06D94-B686-4468-86CF-AA68BB5CFEF4",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:belden:hirschmann_rail_switch_power_smart:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "BC6487F7-284A-40C2-B70D-9380AD2A47C1",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:belden:hirschmann_hisecos:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B26FD56D-F11E-4990-A329-DBC18F40EFDE",
              "versionEndIncluding": "03.2.00",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:belden:hirschmann_eagle20:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "771189D9-34F0-400D-938B-2AA218C28C43",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:belden:hirschmann_eagle30:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "3DCF228A-F3A8-4B36-A105-04E88980BA76",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A buffer overflow vulnerability was found in some devices of Hirschmann Automation and Control HiOS and HiSecOS. The vulnerability is due to improper parsing of URL arguments. An attacker could exploit this vulnerability by specially crafting HTTP requests to overflow an internal buffer. The following devices using HiOS Version 07.0.02 and lower are affected: RSP, RSPE, RSPS, RSPL, MSP, EES, EES, EESX, GRS, OS, RED. The following devices using HiSecOS Version 03.2.00 and lower are affected: EAGLE20/30."
    },
    {
      "lang": "es",
      "value": "Se detect\u00f3 una vulnerabilidad de desbordamiento de b\u00fafer en algunos dispositivos de Hirschmann Automation and Control HiOS y HiSecOS. La vulnerabilidad es debido al an\u00e1lisis inapropiado de los argumentos de la URL. Un atacante podr\u00eda explotar esta vulnerabilidad mediante peticiones HTTP especialmente dise\u00f1adas para desbordar un b\u00fafer interno. Los siguientes dispositivos que usan HiOS Versi\u00f3n 07.0.02 y anteriores est\u00e1n afectados: RSP, RSPE, RSPS, RSPL, MSP, EES, EES, EESX, GRS, OS, RED. Los siguientes dispositivos que usan HiSecOS Versi\u00f3n 03.2.00 y anteriores est\u00e1n afectados: EAGLE20 / 30."
    }
  ],
  "id": "CVE-2020-6994",
  "lastModified": "2024-11-21T05:36:27.270",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-04-03T19:15:13.250",
  "references": [
    {
      "source": "ics-cert@hq.dhs.gov",
      "tags": [
        "Mitigation",
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "https://www.us-cert.gov/ics/advisories/icsa-20-091-01"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mitigation",
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "https://www.us-cert.gov/ics/advisories/icsa-20-091-01"
    }
  ],
  "sourceIdentifier": "ics-cert@hq.dhs.gov",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-12"
        }
      ],
      "source": "ics-cert@hq.dhs.gov",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-120"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.