What is the CVSS score of CVE-2017-6023?

CVE-2017-6023 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 4.0%.

Ethernet Module Configuration Tool Cbe Firmware CVE-2017-6023

CRITICAL

Stack-based Buffer Overflow (CWE-121)

2017-03-16 ics-cert@hq.dhs.gov

Buffer Overflow RCE Stack Overflow Ethernet Module Configuration Tool Cbe Firmware Ethernet Module Configuration Tool Cbeh Firmware Ethernet Module Configuration Tool Cm25E Firmware Ethernet Module Configuration Tool Cm55E Firmware

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Mar 16, 2017 - 04:59 cve.org

CRITICAL 9.8

DescriptionCVE.org

An issue was discovered in Fatek Automation PLC Ethernet Module. The affected Ether_cfg software configuration tool runs on the following Fatek PLCs: CBEH versions prior to V3.6 Build 170215, CBE versions prior to V3.6 Build 170215, CM55E versions prior to V3.6 Build 170215, and CM25E versions prior to V3.6 Build 170215. A stack-based buffer overflow vulnerability has been identified, which may allow remote code execution or crash the affected device.

AnalysisAI

An issue was discovered in Fatek Automation PLC Ethernet Module. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-121. An issue was discovered in Fatek Automation PLC Ethernet Module. The affected Ether_cfg software configuration tool runs on the following Fatek PLCs: CBEH versions prior to V3.6 Build 170215, CBE versions prior to V3.6 Build 170215, CM55E versions prior to V3.6 Build 170215, and CM25E versions prior to V3.6 Build 170215. A stack-based buffer overflow vulnerability has been identified, which may allow remote code execution or crash the affected device. Affected products include: Fatek Ethernet Module Configuration Tool Cbe Firmware, Fatek Ethernet Module Configuration Tool Cbeh Firmware, Fatek Ethernet Module Configuration Tool Cm25E Firmware, Fatek Ethernet Module Configuration Tool Cm55E Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.