Input validation

2020-12-1520:15:00

PRIOn knowledge base

www.prio-n.com

7.5 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

41.4%

JSON

The length of the input fields of Host Engineering H0-ECOM100, H2-ECOM100, and H4-ECOM100 modules are verified only on the client side when receiving input from the configuration web server, which may allow an attacker to bypass the check and send input to crash the device.

CPENameOperatorVersion
h0-ecom100_firmwarele4.0.348
h0-ecom100_firmwarele4.1.113
h0-ecom100_firmwarele5.0.149
h2-ecom100_firmwarele4.0.2148
h2-ecom100_firmwarele5.0.1043
h4-ecom100_firmwarele4.0.2148

Name	Operator	Version
h0-ecom100_firmware	le	4.0.348
h0-ecom100_firmware	le	4.1.113
h0-ecom100_firmware	le	5.0.149
h2-ecom100_firmware	le	4.0.2148
h2-ecom100_firmware	le	5.0.1043
h4-ecom100_firmware	le	4.0.2148

References

us-cert.cisa.gov/ics/advisories/icsa-20-345-02