Lucene search

TalosCVE-2024-36980

HistorySep 18, 2024 - 3:15 p.m.

CVE-2024-36980

2024-09-1815:15:14

CWE-125

talos

web.nvd.nist.gov

openplc

out-of-bounds read

denial of service

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

6.9

Confidence

High

EPSS

0.001

Percentile

17.8%

JSON

An out-of-bounds read vulnerability exists in the OpenPLC Runtime EtherNet/IP PCCC parser functionality of OpenPLC_v3 b4702061dc14d1024856f71b4543298d77007b88. A specially crafted network request can lead to denial of service. An attacker can send a series of EtherNet/IP requests to trigger this vulnerability.This is the first instance of the incorrect comparison.

Affected configurations

Vulners

Vulnrichment

Node

openplcopenplc_v3Range≤b4702061dc14d1024856f71b4543298d77007b88

VendorProductVersionCPE
openplcopenplc_v3*cpe:2.3:a:openplc:openplc_v3:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
openplc	openplc_v3	*	cpe:2.3:a:openplc:openplc_v3::::::::

CNA Affected

[
  {
    "vendor": "OpenPLC",
    "product": "OpenPLC_v3",
    "versions": [
      {
        "version": "b4702061dc14d1024856f71b4543298d77007b88",
        "status": "affected"
      }
    ]
  }
]

References

talosintelligence.com/vulnerability_reports/TALOS-2024-2004

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

6.9

Confidence

High

EPSS

0.001

Percentile

17.8%

JSON

Related for CVE-2024-36980