CVE-2020-6083 Denial of service in Allen Bradley
A specially crafted network request causes loss of communications in Allen-Bradley Flex IO devices, resulting in denial-of-service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-6083?
CVE-2020-6083 is a high-severity denial of service vulnerability in Allen Bradley, published on 14 Oct 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An exploitable denial of service vulnerability exists in the ENIP Request Path Port Segment functionality of Allen-Bradley Flex IO 1794-AENT/B. A specially crafted network request can cause a loss of communications with the device resulting in denial-of-service. An attacker can send a malicious packet to trigger this vulnerability.
Weakness: CWE-120
Which versions are affected by CVE-2020-6083?
It affects 1 product.
Products include Rockwellautomation Allen-Bradley Flex Io 1794-Aent\/B Firmware.
How do I fix CVE-2020-6083?
No fix has been published for CVE-2020-6083 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2020-6083 being exploited?
There is no known exploitation of CVE-2020-6083 in the wild and no public exploit code.
Sources
Also known as GHSA-x37f-5xr3-qgfw.