CVE Vulnerability

CVE-2020-12526

TwinCAT OPC UA Server in versions up to 2.3.0.12 and IPC Diagnostics UA Server in versions up to 3.1.0.1 from Beckhoff Automation GmbH & Co. KG are vulnerable to denial of service attacks. The attacker needs to send several specifically crafted requests to the running OPC UA server. After some of these requests the OPC UA server is no longer responsive to any client. This is without effect to the real-time functionality of IPCs.

5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

Scope

5.3 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://download.beckhoff.com/download/Document/product-security/Advisories/advisory-2021-001.pdf Vendor Advisory
https://cert.vde.com/en-us/advisories/vde-2020-051 Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:beckhoff:ipc_diagnostics_ua_server:*:*:*:*:*:*:*:*
cpe:2.3:a:beckhoff:tf6100:*:*:*:*:*:*:*:*
cpe:2.3:a:beckhoff:twincat_opc_ua_server:*:*:*:*:*:*:*:*
Information

Published : 2021-05-13 02:15

Updated : 2021-05-25 03:02

NVD link : CVE-2020-12526

Mitre link : CVE-2020-12526

Products Affected
No products.
CWE
CWE-20