Rockwell 1756-EN4TR/EN4TRXT CVE-2020-8802/8803 Vulnerability Advisory

Critical Vulnerability Information Vulnerability Overview Product: 1756-ENT2R, EN4TR, EN4TRXT CVE ID: CVE-2020-8802, CVE-2020-8803 Severity: High Affected Products and Versions Security Issue Details CVE III - Description: A security vulnerability exists in the protocol mode of 1756-EN4TR and 1756-EN4TRXT devices. If an attacker can access EtherNet/IP communication and send specific messages to the control port TCP/44818, it may result in an unintended system reboot and loss of data availability. - CVSS 3.1 Base Score: 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) - CVSS 4.0 Base Score: 7.1 (E:A/RL:O/RC:C) - CWEs: CWE-20: Improper Input Validation CVE III - Description: A security vulnerability exists in the protection mode of the 1756-EN4TR device. If an attacker can send specially crafted messages to port TCP/44818, it may cause the device to crash. - CVSS 3.1 Base Score: 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) - CVSS 4.0 Base Score: 7.1 (E:A/RL:O/RC:C) - CWEs: CWE-705: Incorrect Handling of Exceptional Conditions Mitigations and Workarounds Customers using affected software who cannot upgrade to the fixed version should implement firewall policies. Revision History Version: 1.0 Date: September 9, 2020 Description: Initial release

Goal Reached Thanks to every supporter — we hit 100%!

Rockwell 1756-EN4TR/EN4TRXT CVE-2020-8802/8803 Vulnerability Advisory