Vulnerability · Published Nov 24, 2020 · Assigned by icscert
CVE-2020-25159Real Time Automation EtherNet/IP
Critical 9.8
In plain English
A critical-severity stack buffer overflow in 499ES EtherNet/IP (ENIP) Adaptor Source Code from Real Time Automation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.0% (higher than 88% of all known vulnerabilities).
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)3.0%top 12.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
499ES EtherNet/IP (ENIP) Adaptor Source Code is vulnerable to a stack-based buffer overflow, which may allow an attacker to send a specially crafted packet that may result in a denial-of-service condition or code execution.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Real Time Automation | 499ES EtherNet/IP (ENIP) Adaptor Source Code | unspecified – before 2.28 |
Weakness: CWE-121
References
- https://us-cert.cisa.gov/ics/advisories/icsa-20-324-03 x_refsource_MISC