CVE-2020-6087
First published: Wed Oct 14 2020(Updated: )
An exploitable denial of service vulnerability exists in the ENIP Request Path Data Segment functionality of Allen-Bradley Flex IO 1794-AENT/B. A specially crafted network request can cause a loss of communications with the device resulting in denial-of-service. An attacker can send a malicious packet to trigger this vulnerability If the ANSI Extended Symbol Segment Sub-Type is supplied, the device treats the byte following as the Data Size in words. When this value represents a size greater than what remains in the packet data, the device enters a fault state where communication with the device is lost and a physical power cycle is required.
Credit: talos-cna@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Rockwellautomation Flex I\/o 1794-aent\/b Firmware | =4.003 | |
| Rockwellautomation Flex I\/o 1794-aent\/b |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
- collector/nvd-index
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/severity
- agent/references
- agent/author
- agent/last-modified-date
- agent/type
- agent/event
- agent/tags
- agent/first-publish-date
- agent/description
- vendor/rockwellautomation
- canonical/rockwellautomation flex i\/o 1794-aent\/b firmware
- version/rockwellautomation flex i\/o 1794-aent\/b firmware/4.003
- canonical/rockwellautomation flex i\/o 1794-aent\/b