by Kastro
Paper/Archive/CVE-2023-7243

CVE-2023-7243

CISA Industrial Control Systems Network Protocol Parsers (ICSNPP) - Ethercat Plugin for Zeek — Ethercat Zeek Plugin Out-of-bounds Write

EPSS 0.8%CVSS 9.8
critical.is priorityof 100
41
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 57.2.572 × 2011.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Industrial Control Systems Network Protocol Parsers (ICSNPP) - Ethercat Zeek Plugin versions d78dda6 and prior are vulnerable to out-of-bounds write while analyzing specific Ethercat datagrams. This could allow an attacker to cause arbitrary code execution.

Affected

ProductAffectedFixed inSource
Industrial Control Systems Network Protocol Parsers (ICSNPP) - Ethercat Plugin for Zeek≤ d78dda6–CNA
icsnpp-ethercat< d78dda6d78dda6CISA-ADP

Scores by source

icscert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcisa.gov/news-events/ics-advisories/icsa-24-051-02