What is the CVSS score of CVE-2021-20986?

CVE-2021-20986 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 1.0%.

Profinet Io Device Firmware CVE-2021-20986

HIGH

Out-of-bounds Write (CWE-787)

2021-02-16 info@cert.vde.com

Buffer Overflow Denial Of Service Memory Corruption Profinet Io Device Firmware Pgv100 F200A B17 V1D Firmware Pgv150I F200A B17 V1D Firmware Pgv100 F200 B17 V1D 7477 Firmware Pxv100 F200 B17 V1D Firmware Pxv100 F200 B17 V1D 3636 Firmware Pcv80 F200 B17 V1D Firmware Pcv100 F200 B17 V1D Firmware Pcv50 F200 B17 V1D Firmware Pcv100 F200 B17 V1D 6011 6997 Firmware Pcv100 F200 B17 V1D 6011 Firmware Pcv100 F200 B17 V1D 6011 8203 Firmware Pxv100A F200 B28 V1D Firmware Pxv100A F200 B28 V1D 6011 Firmware Pgv100A F200 B28 V1D Firmware Pgv100A F200A B28 V1D Firmware Pgv100Aq F200A B28 V1D Firmware Pgv100Aq F200 B28 V1D Firmware Pxv100Aq F200 B28 V1D Firmware Pxv100Aq F200 B28 V1D 6011 Firmware Ohv F230 B17 Firmware Oit500 F113B17 Cb Firmware Pha Firmware Wcs Firmware

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVE Published

Feb 16, 2021 - 17:15 nvd

HIGH 7.5

DescriptionNVD

A Denial of Service vulnerability was found in Hilscher PROFINET IO Device V3 in versions prior to V3.14.0.7. This may lead to unexpected loss of cyclic communication or interruption of acyclic communication.

AnalysisAI

A Denial of Service vulnerability was found in Hilscher PROFINET IO Device V3 in versions prior to V3.14.0.7. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Out-of-bounds Write (CWE-787), which allows attackers to write data beyond allocated buffer boundaries leading to code execution or crashes. A Denial of Service vulnerability was found in Hilscher PROFINET IO Device V3 in versions prior to V3.14.0.7. This may lead to unexpected loss of cyclic communication or interruption of acyclic communication. Affected products include: Hilscher Profinet Io Device Firmware, Pepperl-Fuchs Pgv100-F200A-B17-V1D Firmware, Pepperl-Fuchs Pgv150I-F200A-B17-V1D Firmware, Pepperl-Fuchs Pgv100-F200-B17-V1D-7477 Firmware, Pepperl-Fuchs Pxv100-F200-B17-V1D Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate write boundaries, use memory-safe languages, enable compiler protections (ASLR, stack canaries).