CVE-2020-16209

A malicious attacker could exploit the interface of the Fieldcomm Group HART-IP (release 1.0.0.0) by constructing messages with sufficiently large payloads to overflow the internal buffer and crash the device, or obtain control of the device.

CVSS v3 9.8 CRITICAL
CVSS v2.0 10.0 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

10.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://www.cisa.gov/uscert/ics/advisories/icsa-20-287-04	Mitigation Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

cpe:2.3:a:fieldcommgroup:hipserver:3.6.1:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:fieldcommgroup:hart-ip_developer_kit_firmware:1.0.0.0:*:*:*:*:*:*:*

cpe:2.3:h:fieldcommgroup:hart-ip_developer_kit:-:*:*:*:*:*:*:*

History

02 Jun 2022, 14:08

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : 10.0 v3 : 9.8
CPE		cpe:2.3:o:fieldcommgroup:hart-ip_developer_kit_firmware:1.0.0.0:::::::* cpe:2.3:a:fieldcommgroup:hipserver:3.6.1:::::::* cpe:2.3:h:fieldcommgroup:hart-ip_developer_kit:-:::::::*
References	~~(MISC) https://www.cisa.gov/uscert/ics/advisories/icsa-20-287-04 -~~	(MISC) https://www.cisa.gov/uscert/ics/advisories/icsa-20-287-04 - Mitigation, Third Party Advisory, US Government Resource

19 May 2022, 18:32

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-05-19 18:15

Updated : 2024-02-04 22:29

NVD link : CVE-2020-16209

Mitre link : CVE-2020-16209

CVE.ORG link : CVE-2020-16209

JSON object : View

Products Affected

fieldcommgroup

hart-ip_developer_kit_firmware
hart-ip_developer_kit
hipserver

CWE

CWE-121

Stack-based Buffer Overflow

{"id": "CVE-2020-16209", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2022-05-19T18:15:08.430", "references": [{"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-20-287-04", "tags": ["Mitigation", "Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-121"}]}], "descriptions": [{"lang": "en", "value": "A malicious attacker could exploit the interface of the Fieldcomm Group HART-IP (release 1.0.0.0) by constructing messages with sufficiently large payloads to overflow the internal buffer and crash the device, or obtain control of the device."}, {"lang": "es", "value": "Un atacante malicioso podr\u00eda explotar la interfaz del Grupo Fieldcomm HART-IP (versi\u00f3n 1.0.0.0) al construir mensajes con cargas \u00fatiles suficientemente grandes para desbordar el b\u00fafer interno y bloquear el dispositivo, u obtener el control del mismo"}], "lastModified": "2022-06-02T14:08:37.457", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fieldcommgroup:hipserver:3.6.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A9591FBC-CBC0-47EA-9C8F-6B0AB8709D6E"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:fieldcommgroup:hart-ip_developer_kit_firmware:1.0.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BE244838-1D9A-4A16-A006-24EB5EBFAE7E"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:fieldcommgroup:hart-ip_developer_kit:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "1DE985B8-643F-4D76-B595-4D730AA1D5BA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}