VDE-2019-019

Vulnerability from csaf_beckhoffautomationgmbhcokg - Published: 2019-10-09 10:00 - Updated: 2025-05-14 13:00
Summary
Beckhoff: TwinCAT Denial-of-Service in Profinet driver
Notes
Summary: In case TwinCAT is configured to use the Profinet driver, a denial of service of the controller could be reached by sending special packets to the device.
Impact: TwinCAT includes a Profinet driver, which could be configured in the engineering environment to use Profinet connections to the controller. In case this is configured and the controller is started, a specially crafted Profinet DCP packet could be sent to the TwinCAT device, which will lead to a denial of service of the device. Operation can be resumed by restarting the device.
Remediation: Profinet could be blocked in perimeter firewall to block PROFINET DCP packets from untrusted networks to the device. Beckhoff will provide updates for the mentioned TwinCAT Versions.
CVE-2019-5637

When Beckhoff TwinCAT is configured to use the Profinet driver, a denial of service of the controller could be reached by sending a malformed UDP packet to the device. This issue affects TwinCAT 2 version 2304 (and prior) and TwinCAT 3.1 version 4204.0 (and prior).

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-369 - Divide By Zero
Vendor Fix Profinet could be blocked in perimeter firewall to block PROFINET DCP packets from untrusted networks to the device. Beckhoff will provide updates for the mentioned TwinCAT Versions.
Affected products
Product Identifier Version Remediation
TwinCAT 2305
Beckhoff / Software / TwinCAT
 2305
TwinCAT 4204.1
Beckhoff / Software / TwinCAT
 4204.1
Product Identifier Version Remediation
TwinCAT <=2304
Beckhoff / Software / TwinCAT
 <=2304
TwinCAT <=4204.0
Beckhoff / Software / TwinCAT
 <=4204.0
References
Acknowledgments
CERT@VDE certvde.com
Rapid7 Andreas Galauner
To clipboard 

{
  "document": {
    "acknowledgments": [
      {
        "organization": "CERT@VDE",
        "summary": "coordination",
        "urls": [
          "https://certvde.com"
        ]
      },
      {
        "names": [
          "Andreas Galauner"
        ],
        "organization": "Rapid7",
        "summary": "coordination"
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-GB",
    "notes": [
      {
        "category": "summary",
        "text": "In case TwinCAT is configured to use the Profinet driver, a denial of service of the controller could be reached by sending special packets to the device.",
        "title": "Summary"
      },
      {
        "category": "description",
        "text": "TwinCAT includes a Profinet driver, which could be configured in the engineering environment to use Profinet connections to the controller.\n\nIn case this is configured and the controller is started, a specially crafted Profinet DCP packet could be sent to the TwinCAT device, which will lead to a denial of service of the device.\n\nOperation can be resumed by restarting the device.",
        "title": "Impact"
      },
      {
        "category": "description",
        "text": "Profinet could be blocked in perimeter firewall to block PROFINET DCP packets from untrusted networks to the device.\n\nBeckhoff will provide updates for the mentioned TwinCAT Versions.",
        "title": "Remediation"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "product-securityincident@beckhoff.com",
      "name": "Beckhoff Automation GmbH \u0026 Co. KG",
      "namespace": "https://www.beckhoff.com"
    },
    "references": [
      {
        "category": "external",
        "summary": "CERT@VDE Security Advisories for Beckhoff",
        "url": "https://certvde.com/en/advisories/vendor/beckhoff/"
      },
      {
        "category": "self",
        "summary": "VDE-2019-019: Beckhoff: TwinCAT Denial-of-Service in Profinet driver - HTML",
        "url": "https://certvde.com/en/advisories/VDE-2019-019"
      },
      {
        "category": "self",
        "summary": "VDE-2019-019: Beckhoff: TwinCAT Denial-of-Service in Profinet driver - CSAF",
        "url": "https://beckhoff.csaf-tp.certvde.com/.well-known/csaf/white/2019/vde-2019-019.json"
      }
    ],
    "title": "Beckhoff: TwinCAT Denial-of-Service in Profinet driver",
    "tracking": {
      "aliases": [
        "VDE-2019-019"
      ],
      "current_release_date": "2025-05-14T13:00:14.000Z",
      "generator": {
        "date": "2025-04-11T07:14:12.685Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.5.23"
        }
      },
      "id": "VDE-2019-019",
      "initial_release_date": "2019-10-09T10:00:00.000Z",
      "revision_history": [
        {
          "date": "2019-10-09T10:00:00.000Z",
          "number": "1",
          "summary": "Initial revision."
        },
        {
          "date": "2024-11-06T11:27:01.000Z",
          "number": "2",
          "summary": "Fix: correct certvde domain, added self-reference"
        },
        {
          "date": "2025-04-11T07:00:00.000Z",
          "number": "3",
          "summary": "Fix: version range"
        },
        {
          "date": "2025-05-14T13:00:14.000Z",
          "number": "4",
          "summary": "Fix: added distribution"
        }
      ],
      "status": "final",
      "version": "4"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003c=2304",
                    "product": {
                      "name": "TwinCAT \u003c=2304",
                      "product_id": "CSAFPID-11001"
                    }
                  },
                  {
                    "category": "product_version_range",
                    "name": "\u003c=4204.0",
                    "product": {
                      "name": "TwinCAT \u003c=4204.0",
                      "product_id": "CSAFPID-11002"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "2305",
                    "product": {
                      "name": "TwinCAT 2305",
                      "product_id": "CSAFPID-12001"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "4204.1",
                    "product": {
                      "name": "TwinCAT 4204.1",
                      "product_id": "CSAFPID-12002"
                    }
                  }
                ],
                "category": "product_family",
                "name": "TwinCAT"
              }
            ],
            "category": "product_family",
            "name": "Software"
          }
        ],
        "category": "vendor",
        "name": "Beckhoff"
      }
    ],
    "product_groups": [
      {
        "group_id": "CSAFGID-0001",
        "product_ids": [
          "CSAFPID-11001",
          "CSAFPID-11002"
        ],
        "summary": "Affected products."
      },
      {
        "group_id": "CSAFGID-0002",
        "product_ids": [
          "CSAFPID-12001",
          "CSAFPID-12002"
        ],
        "summary": "Fixed products."
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2019-5637",
      "cwe": {
        "id": "CWE-369",
        "name": "Divide By Zero"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "When Beckhoff TwinCAT is configured to use the Profinet driver, a denial of service of the controller could be reached by sending a malformed UDP packet to the device. This issue affects TwinCAT 2 version 2304 (and prior) and TwinCAT 3.1 version 4204.0 (and prior).",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-12001",
          "CSAFPID-12002"
        ],
        "known_affected": [
          "CSAFPID-11001",
          "CSAFPID-11002"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Profinet could be blocked in perimeter firewall to block PROFINET DCP packets from untrusted networks to the device.\n\nBeckhoff will provide updates for the mentioned TwinCAT Versions.",
          "entitlements": [
            "Please contact your support representative for this particular firmware package and update the corresponding product."
          ],
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "environmentalScore": 7.5,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 7.5,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-11001",
            "CSAFPID-11002"
          ]
        }
      ],
      "title": "CVE-2019-5637"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.