Beckhoff TwinCAT RT Network Driver ICMP Echo Request Memory information disclosure

Summaryinfo

A vulnerability, which was classified as problematic, was found in Beckhoff TwinCAT RT Network Driver. Impacted is an unknown function. Such manipulation as part of ICMP Echo Request leads to information disclosure (Memory). This vulnerability is listed as CVE-2020-12494. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in Beckhoff TwinCAT RT Network Driver (Hardware Driver Software) (affected version not known). It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation as part of a ICMP Echo Request leads to a information disclosure vulnerability (Memory). Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality. CVE summarizes:

Beckhoff’s TwinCAT RT network driver for Intel 8254x and 8255x is providing EtherCAT functionality. The driver implements real-time features. Except for Ethernet frames sent from real-time functionality, all other Ethernet frames sent through the driver are not padded if their payload is less than the minimum Ethernet frame size. Instead, arbitrary memory content is transmitted within in the padding bytes of the frame. Most likely this memory contains slices from previously transmitted or received frames. By this method, memory content is disclosed, however, an attacker can hardly control which memory content is affected. For example, the disclosure can be provoked with small sized ICMP echo requests sent to the device.

The weakness was presented 06/16/2020 (Website). The advisory is shared for download at cert.vde.com. This vulnerability is handled as CVE-2020-12494 since 04/30/2020. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1592.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Hardware Driver Software

Vendor

• Beckhoff

Name

• TwinCAT RT Network Driver

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion