CVE-2017-6023
A stack-based buffer overflow vulnerability has been identified, which may allow remote code execution or crash the affected device.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (4.41%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
An issue was discovered in Fatek Automation PLC Ethernet Module. The affected Ether_cfg software configuration tool runs on the following Fatek PLCs: CBEH versions prior to V3.6 Build 170215, CBE versions prior to V3.6 Build 170215, CM55E versions prior to V3.6 Build 170215, and CM25E versions prior to V3.6 Build 170215. A stack-based buffer overflow vulnerability has been identified, which may allow remote code execution or crash the affected device.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 4.41% probability · 91th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-121, CWE-119
- Affected
- fatek/ethernet module configuration tool cbe firmware · fatek/ethernet module configuration tool cbeh firmware · fatek/ethernet module configuration tool cm25e firmware · fatek/ethernet module configuration tool cm55e firmware
- Source
- ics-cert@hq.dhs.gov
References
- http://www.securityfocus.com/bid/96892Third Party Advisory, VDB Entry
- https://ics-cert.us-cert.gov/advisories/ICSA-17-073-01Third Party Advisory, US Government Resource
- http://www.securityfocus.com/bid/96892Third Party Advisory, VDB Entry
- https://ics-cert.us-cert.gov/advisories/ICSA-17-073-01Third Party Advisory, US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.