Lucene search

IcscertCVE-2020-27274

HistoryJan 26, 2021 - 7:15 p.m.

CVE-2020-27274

2021-01-2619:15:12

CWE-754

icscert

web.nvd.nist.gov

cve-2020-27274

denial of service

parsing functions

opc ua tunneller

nvd

security vulnerability

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.4

Confidence

High

EPSS

0.001

Percentile

49.3%

JSON

Some parsing functions in the affected product do not check the return value of malloc and the thread handling the message is forced to close, which may lead to a denial-of-service condition on the OPC UA Tunneller (versions prior to 6.3.0.8233).

Affected configurations

Nvd

Node

honeywellopc_ua_tunnellerRange<6.3.0.8233

VendorProductVersionCPE
honeywellopc_ua_tunneller*cpe:2.3:a:honeywell:opc_ua_tunneller:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
honeywell	opc_ua_tunneller	*	cpe:2.3:a:honeywell:opc_ua_tunneller::::::::

CNA Affected

[
  {
    "product": "OPC UA Tunneller",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "All versions prior to 6.3.0.8233"
      }
    ]
  }
]

References

us-cert.cisa.gov/ics/advisories/icsa-21-021-03

Social References

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.4

Confidence

High

EPSS

0.001

Percentile

49.3%

JSON

Related for CVE-2020-27274