Back

CVE-2024-39590

Sept. 18, 2024, 3:15 p.m.

Received
CVE has been recently published to the CVE List and has been received by the NVD.

Products

OpenPLC_v3

  • 16bf8bac1a36d95b73e7b8722d0edb8b9c5bb56a

Source

talos-cna@cisco.com

Tags

talos-cna@cisco.com
CWE-704
2024-09-18
CVE-2024-39590

CVE-2024-39590 details

Published : Sept. 18, 2024, 3:15 p.m.
Last Modified : Sept. 18, 2024, 3:15 p.m.

Description

Multiple invalid pointer dereference vulnerabilities exist in the OpenPLC Runtime EtherNet/IP parser functionality of OpenPLC_v3 16bf8bac1a36d95b73e7b8722d0edb8b9c5bb56a. A specially crafted EtherNet/IP request can lead to denial of service. An attacker can send a series of EtherNet/IP requests to trigger these vulnerabilities.This instance of the vulnerability occurs within the `Protected_Logical_Write_Reply` function

CVSS Score

1 2 3 4 5 6 7.5 8 9 10

Weakness

Weakness Name Description
CWE-704 Incorrect Type Conversion or Cast The product does not correctly convert an object, resource, or structure from one type to a different type.

CVSS Data

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

Base Score

7.5

Exploitability Score

3.9

Impact Score

3.6

Base Severity

HIGH

Vector String : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

URL Source
https://talosintelligence.com/vulnerability_reports/TALOS-2024-2016 talos-cna@cisco.com
This website uses the NVD API, but is not approved or certified by it.