Vulnerability · Published May 13, 2021 · Assigned by CERTVDE
CVE-2021-20988Hilscher rcX RTOS: Wrong handling of the UDP checksum
High 8.6
In plain English
A high-severity memory corruption in rcX RTOS from Hilscher. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities).
Severity (CVSS 3.1)8.6High
Exploit odds (30 days)1.0%top 37.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In Hilscher rcX RTOS versions prios to V2.1.14.1 the actual UDP packet length is not verified against the length indicated by the packet. This may lead to a denial of service of the affected device.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Hilscher | rcX RTOS | unspecified – before V2.1.14.1 |
| Pepperl+Fuchs | Ethernet IO Modules ICE1-16 | ICE1-16DI-G60L-V1D – through F10017ICE1-16DIO-G60L-C1-V1D – through F10017ICE1-16DIO-G60L-V1D – through F10017 |
| Pepperl+Fuchs | Ethernet IO Modules ICE1-8 | ICE1-8DI8DO-G60L-C1-V1D – through F10017ICE1-8DI8DO-G60L-V1D – through F10017ICE1-8IOL-G30L-V1D – through F10017ICE1-8IOL-G60L-V1D – through F10017ICE1-8IOL-S2-G60L-V1D – through F10017 |
Weakness: CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
References
- https://kb.hilscher.com/display/ISMS/2019-04-10+Wrong+handling+of+the+UDP+checksum x_refsource_CONFIRM
- https://cert.vde.com/de-de/advisories/vde-2021-018 x_refsource_CONFIRM