by Kastro
Paper/Archive/CVE-2023-7244

CVE-2023-7244

CISA Industrial Control Systems Network Protocol Parsers (ICSNPP) - Ethercat Plugin for Zeek — Ethercat Zeek Plugin Out-of-bounds Write

EPSS 0.8%CVSS 9.8
critical.is priorityof 100
41
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 57.2.572 × 2011.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Industrial Control Systems Network Protocol Parsers (ICSNPP) - Ethercat Zeek Plugin versions d78dda6 and prior are vulnerable to out-of-bounds write in their primary analyses function for Ethercat communication packets. This could allow an attacker to cause arbitrary code execution.

Affected

ProductAffectedFixed inSource
Industrial Control Systems Network Protocol Parsers (ICSNPP) - Ethercat Plugin for Zeek≤ d78dda6–CNA
icsnpp-ethercat≤ d78dda6–CISA-ADP

Scores by source

icscert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcisa.gov/news-events/ics-advisories/icsa-24-051-02