EUVD-2026-51382
GHSA-2rc3-cp6m-h3p7
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent-only attack requiring high DNP3 privileges; high availability loss from restart loop; low integrity impact from malformed command; no confidentiality breach or scope change.
Primary rating from Vendor (CSA).
CVSS VectorVendor: CSA
Lifecycle Timeline
1DescriptionCVE.org
A denial of service vulnerability in the Advantech ECU-1251D allows a network-adjacent attacker to send a DNP3 signal to the Digital Output address of the device, causing the DNP3Daemon to invoke a non-existent system file and enter an indefinite restart loop. While the device remains partially accessible via its web panel or direct signals, an operator using SCADA TelWin is unable to reconnect until the device is manually restarted.
AnalysisAI
Denial of service in the Advantech ECU-1251D industrial communication gateway allows a network-adjacent, high-privilege attacker to send a crafted DNP3 signal to the device's Digital Output address, forcing the DNP3Daemon into an indefinite restart loop and severing SCADA TelWin operator connectivity until a manual restart is performed. The device remains partially reachable via its web panel during the loop, which may create a false impression of operational continuity while SCADA control is lost. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; the disclosure source is Singapore's Cyber Security Agency (CSA).
Technical ContextAI
The ECU-1251D is an Advantech industrial protocol gateway deployed in OT and ICS environments to bridge field devices with SCADA systems such as TelWin. It implements the DNP3 (Distributed Network Protocol 3) protocol - a serial/IP communications standard widely used in utilities, water treatment, and energy sectors for supervisory control. The vulnerable component is the DNP3Daemon, the resident service handling inbound DNP3 messages. When a DNP3 command is directed at the device's Digital Output address, the daemon attempts to invoke a system file that does not exist on the filesystem rather than failing gracefully, causing an unhandled error that results in a persistent restart loop. This behavior is consistent with CWE-754 (Improper Check for Unusual or Exceptional Conditions) or CWE-390 (Detection of Error Condition Without Action), though no CWE has been formally assigned. The CPE cpe:2.3:a:advantech:ecu-1251d:*:*:*:*:*:*:*:* indicates all known firmware versions are potentially affected.
RemediationAI
No vendor-released patch has been identified at time of analysis. As a primary compensating control, restrict DNP3 traffic to the ECU-1251D's Digital Output address to only explicitly trusted and authorized source systems using industrial firewalls or access control lists at the network perimeter; note this may temporarily limit legitimate operator access during rule deployment and requires coordination with operations teams. Implement network segmentation to place the ECU-1251D on a dedicated VLAN with strict ingress filtering, reducing the pool of systems that can achieve the required network adjacency (AV:A). Where the network infrastructure supports it, deploy DNP3-aware deep packet inspection or application-layer filtering to detect and block malformed Digital Output commands. Establish automated monitoring for unexpected DNP3Daemon process restarts as an early indicator of exploitation or device instability, and document and rehearse the manual restart procedure to minimize mean time to recovery. Consult the CSA advisory at https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-095/ and contact Advantech directly for firmware updates or official mitigations.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today