CVE-2021-20986 Hilscher: Denial of Service vulnerability in PROFINET IO Device
Attackers can cause loss of cyclic or interruption of acyclic communication in Hilscher PROFINET IO Devices, disrupting industrial operations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-20986?
CVE-2021-20986 is a high-severity denial of service vulnerability in Hilscher OHV, published on 16 Feb 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A Denial of Service vulnerability was found in Hilscher PROFINET IO Device V3 in versions prior to V3.14.0.7. This may lead to unexpected loss of cyclic communication or interruption of acyclic communication.
Weakness: CWE-787
Which versions are affected by CVE-2021-20986?
It affects 24 products.
Products include Hilscher Profinet Io Device Firmware, Pepperl-Fuchs Ohv-F230-B17 Firmware, Pepperl-Fuchs Oit500-F113b17-Cb Firmware, Pepperl-Fuchs Pcv100-F200-B17-V1d-6011-6997 Firmware, Pepperl-Fuchs Pcv100-F200-B17-V1d-6011-8203 Firmware, Pepperl-Fuchs Pcv100-F200-B17-V1d-6011 Firmware and 18 more.
How do I fix CVE-2021-20986?
No fix has been published for CVE-2021-20986 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-20986 being exploited?
There is no known exploitation of CVE-2021-20986 in the wild and no public exploit code.
Sources
Also known as GHSA-4p8g-xcvq-m8r7.