Vulnerability-Lookup

FKIE_CVE-2020-12494

Vulnerability from fkie_nvd - Published: 2020-06-16 14:15 - Updated: 2026-06-17 02:51

Severity

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Summary

Beckhoff's TwinCAT RT network driver for Intel 8254x and 8255x is providing EtherCAT functionality. The driver implements real-time features. Except for Ethernet frames sent from real-time functionality, all other Ethernet frames sent through the driver are not padded if their payload is less than the minimum Ethernet frame size. Instead, arbitrary memory content is transmitted within in the padding bytes of the frame. Most likely this memory contains slices from previously transmitted or received frames. By this method, memory content is disclosed, however, an attacker can hardly control which memory content is affected. For example, the disclosure can be provoked with small sized ICMP echo requests sent to the device.

References

	URL	Tags
	info@cert.vde.com	https://cert.vde.com/en-us/advisories/vde-2020-019	Third Party Advisory
	af854a3a-2127-422b-91ae-364da2661108	https://cert.vde.com/en-us/advisories/vde-2020-019	Third Party Advisory

Impacted products

Vendor	Product	Version
beckhoff	twincat_driver	*
beckhoff	twincat	3.1
intel	82540em	-
intel	82540ep	-
intel	82541ei	-
intel	82541er	-
intel	82541gi	-
intel	82541pi	-
intel	82544ei	-
intel	82544gc	-
intel	82545em	-
intel	82545gm	-
intel	82546eb	-
intel	82546gb	-
intel	82547ei	-
intel	82547gi	-
beckhoff	twincat	*
beckhoff	twincat	3.1
intel	82540em	-
intel	82540ep	-
intel	82541ei	-
intel	82541er	-
intel	82541gi	-
intel	82541pi	-
intel	82544ei	-
intel	82544gc	-
intel	82545em	-
intel	82545gm	-
intel	82546eb	-
intel	82546gb	-
intel	82547ei_	-
intel	82547gi	-
beckhoff	twincat	*
beckhoff	twincat	2.11
intel	82540em	-
intel	82540ep	-
intel	82541ei	-
intel	82541er	-
intel	82541gi	-
intel	82541pi	-
intel	82544ei	-
intel	82544gc	-
intel	82545em	-
intel	82545gm	-
intel	82546eb	-
intel	82546gb	-
intel	82547ei_	-
intel	82547gi	-
beckhoff	twincat	*
beckhoff	twincat	3.1
intel	82557	-
intel	82558	-
intel	82559	-
beckhoff	twincat	*
beckhoff	twincat	3.1
intel	82557	-
intel	82558	-
intel	82559	-
beckhoff	twincat	*
beckhoff	twincat	2.11
intel	82557	-
intel	82558	-
intel	82559	-

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "TwinCat Driver for Intel 8254x (Tcl8254x.sys)",
          "vendor": "Beckhoff",
          "versions": [
            {
              "lessThanOrEqual": "3.1.0.3603 for TwinCAT 3.1 4024",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "3.1.0.3512 for TwinCAT 3.1 4022",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "2.11.0.2120 for TwinCAT 2.11 2350",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "TwinCat Driver for Intel 8255x (Tcl8255x.sys)",
          "vendor": "Beckhoff",
          "versions": [
            {
              "lessThanOrEqual": "3.1.0.3600 for TwinCAT 3.1 4024",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "3.1.0.3500 for TwinCAT 3.1 4024",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "2.11.0.2117 for TwinCAT 2.11 2350",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "info@cert.vde.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:beckhoff:twincat_driver:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BA181C43-953B-483C-B34E-74089B1F56E2",
              "versionEndIncluding": "3.1.0.3603",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:beckhoff:twincat:3.1:build_4024:*:*:*:*:*:*",
              "matchCriteriaId": "833123D8-C8C4-4F0B-84E4-34149B0FFA67",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:intel:82540em:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "50C24972-C85A-4B9D-B49B-64959A3D6EA8",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:intel:82540ep:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F0A7B7D2-1889-4B31-A71D-6128D56A1E98",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:intel:82541ei:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0FF5DE70-0AFB-4C98-B394-CC01ABCC05CE",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:intel:82541er:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "83789ECA-6CF4-4851-814B-8F3BA1B3C924",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:intel:82541gi:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "AB515EAE-EA1B-4095-B98E-B993DE5478E0",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:intel:82541pi:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "C5722E6B-39F4-4B55-B823-0168E8206685",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:intel:82544ei:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "73A17337-9AA4-440C-BBDE-6022FDAB6630",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:intel:82544gc:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5E7FC2A9-9EA6-4B40-A768-E0F2E2B0BA01",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:intel:82545em:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7191B4EF-281A-47C9-9BD0-EC1BA936814A",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:intel:82545gm:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "955D2173-8388-4CD7-8481-05D16F499ED7",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:intel:82546eb:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "52BF5F63-57A5-4794-A8B4-FE38A330FAE9",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:intel:82546gb:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8D7D6376-7FEC-43C7-AC1B-F5BB0AFACD24",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:intel:82547ei:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "CAD4C9C7-165D-432A-9FB1-00599AB53632",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:intel:82547gi:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "6EB8DA28-02A2-4921-BC0A-B4F41CD033BB",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:beckhoff:twincat:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "28813786-BC07-4F45-81DD-6C82E993EBB1",
              "versionEndIncluding": "3.1.0.3512",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:beckhoff:twincat:3.1:build_4022:*:*:*:*:*:*",
              "matchCriteriaId": "A30C25C0-DF20-4F75-B054-04CB69E4828B",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:intel:82540em:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "50C24972-C85A-4B9D-B49B-64959A3D6EA8",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:intel:82540ep:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F0A7B7D2-1889-4B31-A71D-6128D56A1E98",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:intel:82541ei:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0FF5DE70-0AFB-4C98-B394-CC01ABCC05CE",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:intel:82541er:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "83789ECA-6CF4-4851-814B-8F3BA1B3C924",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:intel:82541gi:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "AB515EAE-EA1B-4095-B98E-B993DE5478E0",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:intel:82541pi:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "C5722E6B-39F4-4B55-B823-0168E8206685",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:intel:82544ei:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "73A17337-9AA4-440C-BBDE-6022FDAB6630",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:intel:82544gc:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5E7FC2A9-9EA6-4B40-A768-E0F2E2B0BA01",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:intel:82545em:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7191B4EF-281A-47C9-9BD0-EC1BA936814A",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:intel:82545gm:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "955D2173-8388-4CD7-8481-05D16F499ED7",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:intel:82546eb:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "52BF5F63-57A5-4794-A8B4-FE38A330FAE9",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:intel:82546gb:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8D7D6376-7FEC-43C7-AC1B-F5BB0AFACD24",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:intel:82547ei_:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "127BA9B4-1AC8-4E2A-B988-A6DB74D94005",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:intel:82547gi:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "6EB8DA28-02A2-4921-BC0A-B4F41CD033BB",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:beckhoff:twincat:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "EDAC8A5E-E88D-446D-8259-3DE668C733BF",
              "versionEndIncluding": "2.11.0.2120",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:beckhoff:twincat:2.11:build_2350:*:*:*:*:*:*",
              "matchCriteriaId": "65A29D14-486E-47E4-AEBC-8F1B61AE3C96",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:intel:82540em:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "50C24972-C85A-4B9D-B49B-64959A3D6EA8",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:intel:82540ep:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F0A7B7D2-1889-4B31-A71D-6128D56A1E98",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:intel:82541ei:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0FF5DE70-0AFB-4C98-B394-CC01ABCC05CE",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:intel:82541er:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "83789ECA-6CF4-4851-814B-8F3BA1B3C924",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:intel:82541gi:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "AB515EAE-EA1B-4095-B98E-B993DE5478E0",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:intel:82541pi:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "C5722E6B-39F4-4B55-B823-0168E8206685",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:intel:82544ei:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "73A17337-9AA4-440C-BBDE-6022FDAB6630",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:intel:82544gc:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5E7FC2A9-9EA6-4B40-A768-E0F2E2B0BA01",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:intel:82545em:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7191B4EF-281A-47C9-9BD0-EC1BA936814A",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:intel:82545gm:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "955D2173-8388-4CD7-8481-05D16F499ED7",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:intel:82546eb:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "52BF5F63-57A5-4794-A8B4-FE38A330FAE9",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:intel:82546gb:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8D7D6376-7FEC-43C7-AC1B-F5BB0AFACD24",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:intel:82547ei_:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "127BA9B4-1AC8-4E2A-B988-A6DB74D94005",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:intel:82547gi:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "6EB8DA28-02A2-4921-BC0A-B4F41CD033BB",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:beckhoff:twincat:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "7B2487EF-FA8E-47B7-B64E-C85074E41A5C",
              "versionEndIncluding": "3.1.0.3600",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:beckhoff:twincat:3.1:build_402:*:*:*:*:*:*",
              "matchCriteriaId": "DEFD2024-2C25-4CF2-8594-D5FFA6F37D4A",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:intel:82557:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B15B3AE8-CE85-4859-917F-7761D4C7E0EA",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:intel:82558:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "AEF15ABE-3181-46C6-A77E-01AF0F654E11",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:intel:82559:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7E20AD23-1608-4BC4-A3B3-9BF6ED7975DC",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:beckhoff:twincat:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "34EE5CBB-16DA-4047-B91B-E0EA9A88BF06",
              "versionEndIncluding": "3.1.0.3500",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:beckhoff:twincat:3.1:build_4024:*:*:*:*:*:*",
              "matchCriteriaId": "833123D8-C8C4-4F0B-84E4-34149B0FFA67",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:intel:82557:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B15B3AE8-CE85-4859-917F-7761D4C7E0EA",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:intel:82558:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "AEF15ABE-3181-46C6-A77E-01AF0F654E11",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:intel:82559:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7E20AD23-1608-4BC4-A3B3-9BF6ED7975DC",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:beckhoff:twincat:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E2B6E51B-FDD5-40F4-BBA7-FF2922696D5E",
              "versionEndIncluding": "2.11.0.2117",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:beckhoff:twincat:2.11:build_2350:*:*:*:*:*:*",
              "matchCriteriaId": "65A29D14-486E-47E4-AEBC-8F1B61AE3C96",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:intel:82557:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B15B3AE8-CE85-4859-917F-7761D4C7E0EA",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:intel:82558:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "AEF15ABE-3181-46C6-A77E-01AF0F654E11",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:intel:82559:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7E20AD23-1608-4BC4-A3B3-9BF6ED7975DC",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Beckhoff\u0027s TwinCAT RT network driver for Intel 8254x and 8255x is providing EtherCAT functionality. The driver implements real-time features. Except for Ethernet frames sent from real-time functionality, all other Ethernet frames sent through the driver are not padded if their payload is less than the minimum Ethernet frame size. Instead, arbitrary memory content is transmitted within in the padding bytes of the frame. Most likely this memory contains slices from previously transmitted or received frames. By this method, memory content is disclosed, however, an attacker can hardly control which memory content is affected. For example, the disclosure can be provoked with small sized ICMP echo requests sent to the device."
    },
    {
      "lang": "es",
      "value": "El controlador de red TwinCAT RT de Beckhoff para Intel 8254x y 8255x, proporciona la funcionalidad EtherCAT. El controlador implementa caracter\u00edsticas en tiempo real. A excepci\u00f3n de las tramas Ethernet enviadas desde la funcionalidad en tiempo real, todas las dem\u00e1s tramas Ethernet enviadas por medio del controlador no son rellenadas si su carga \u00fatil es menor que el tama\u00f1o m\u00ednimo de trama Ethernet. En su lugar, el contenido de memoria arbitrario es transmitido dentro de los bytes de relleno de la trama. Lo m\u00e1s probable es que esta memoria contenga segmentos de tramas transmitidas o recibidas previamente. Mediante este m\u00e9todo, se revela el contenido de la memoria, sin embargo, un atacante apenas puede controlar qu\u00e9 contenido de la memoria est\u00e1 afectado. Por ejemplo, la divulgaci\u00f3n puede ser provocada con peticiones echo ICMP de peque\u00f1o tama\u00f1o enviadas al dispositivo"
    }
  ],
  "id": "CVE-2020-12494",
  "lastModified": "2026-06-17T02:51:54.277",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "info@cert.vde.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Secondary"
      }
    ]
  },
  "published": "2020-06-16T14:15:10.977",
  "references": [
    {
      "source": "info@cert.vde.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://cert.vde.com/en-us/advisories/vde-2020-019"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://cert.vde.com/en-us/advisories/vde-2020-019"
    }
  ],
  "sourceIdentifier": "info@cert.vde.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-459"
        }
      ],
      "source": "info@cert.vde.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-459"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Secondary"
    }
  ]
}

CVE-2020-12494 (GCVE-0-2020-12494)

Vulnerability from cvelistv5 – Published: 2020-06-16 13:28 – Updated: 2024-08-04 11:56

Title

Beckhoff: Etherleak in TwinCAT RT network driver

Summary

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-459 - Incomplete Cleanup

Assigner

CERTVDE CNA under the icscert root

CNA scorecard B 76/100 over 167 records in the last 180 days details

References

1 reference

URL	Tags
https://cert.vde.com/en-us/advisories/vde-2020-019	x_refsource_CONFIRM

Impacted products

2 products

Vendor	Product	Version
Beckhoff	TwinCat Driver for Intel 8254x (Tcl8254x.sys)	Affected: unspecified , ≤ 3.1.0.3603 for TwinCAT 3.1 4024 (custom) Affected: unspecified , ≤ 3.1.0.3512 for TwinCAT 3.1 4022 (custom) Affected: unspecified , ≤ 2.11.0.2120 for TwinCAT 2.11 2350 (custom)
Beckhoff	TwinCat Driver for Intel 8255x (Tcl8255x.sys)	Affected: unspecified , ≤ 3.1.0.3600 for TwinCAT 3.1 4024 (custom) Affected: unspecified , ≤ 3.1.0.3500 for TwinCAT 3.1 4024 (custom) Affected: unspecified , ≤ 2.11.0.2117 for TwinCAT 2.11 2350 (custom)

Credits

Beckhoff reported this vulnerability to CERT@VDE

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T11:56:52.090Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://cert.vde.com/en-us/advisories/vde-2020-019"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "TwinCat Driver for Intel 8254x (Tcl8254x.sys)",
          "vendor": "Beckhoff",
          "versions": [
            {
              "lessThanOrEqual": "3.1.0.3603 for TwinCAT 3.1 4024",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "3.1.0.3512 for TwinCAT 3.1 4022",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "2.11.0.2120 for TwinCAT 2.11 2350",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "TwinCat Driver for Intel 8255x (Tcl8255x.sys)",
          "vendor": "Beckhoff",
          "versions": [
            {
              "lessThanOrEqual": "3.1.0.3600 for TwinCAT 3.1 4024",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "3.1.0.3500 for TwinCAT 3.1 4024",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "2.11.0.2117 for TwinCAT 2.11 2350",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Beckhoff reported this vulnerability to CERT@VDE"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Beckhoff\u0027s TwinCAT RT network driver for Intel 8254x and 8255x is providing EtherCAT functionality. The driver implements real-time features. Except for Ethernet frames sent from real-time functionality, all other Ethernet frames sent through the driver are not padded if their payload is less than the minimum Ethernet frame size. Instead, arbitrary memory content is transmitted within in the padding bytes of the frame. Most likely this memory contains slices from previously transmitted or received frames. By this method, memory content is disclosed, however, an attacker can hardly control which memory content is affected. For example, the disclosure can be provoked with small sized ICMP echo requests sent to the device."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-459",
              "description": "CWE-459 Incomplete Cleanup",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-06-19T12:29:17.000Z",
        "orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
        "shortName": "CERTVDE"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://cert.vde.com/en-us/advisories/vde-2020-019"
        }
      ],
      "source": {
        "advisory": "VDE-2020-019",
        "discovery": "UNKNOWN"
      },
      "title": "Beckhoff: Etherleak in TwinCAT RT network driver",
      "workarounds": [
        {
          "lang": "en",
          "value": "If no real-time communication from TwinCAT is required on the Ethernet interface, then users can alternatively re-configure them to use the Intel \u00ae driver, which is shipped with Beckhoff images.\nCustomers should configure a perimeter firewall to block traffic from untrusted networks to the device, especially regarding ICMP and other small ethernet frames.\nBeckhoff offers software patches for TwinCAT 3.1 and TwinCAT 2.11 on request. These patches will be included in the the next regular releases to the affected software versions. The advisory will be updated upon availability."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "AKA": "CERT@VDE",
          "ASSIGNER": "info@cert.vde.com",
          "ID": "CVE-2020-12494",
          "STATE": "PUBLIC",
          "TITLE": "Beckhoff: Etherleak in TwinCAT RT network driver"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "TwinCat Driver for Intel 8254x (Tcl8254x.sys)",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "3.1.0.3603 for TwinCAT 3.1 4024"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_value": "3.1.0.3512 for TwinCAT 3.1 4022"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_value": "2.11.0.2120 for TwinCAT 2.11 2350"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "TwinCat Driver for Intel 8255x (Tcl8255x.sys)",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "3.1.0.3600 for TwinCAT 3.1 4024"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_value": "3.1.0.3500 for TwinCAT 3.1 4024"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_value": "2.11.0.2117 for TwinCAT 2.11 2350"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Beckhoff"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Beckhoff reported this vulnerability to CERT@VDE"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Beckhoff\u0027s TwinCAT RT network driver for Intel 8254x and 8255x is providing EtherCAT functionality. The driver implements real-time features. Except for Ethernet frames sent from real-time functionality, all other Ethernet frames sent through the driver are not padded if their payload is less than the minimum Ethernet frame size. Instead, arbitrary memory content is transmitted within in the padding bytes of the frame. Most likely this memory contains slices from previously transmitted or received frames. By this method, memory content is disclosed, however, an attacker can hardly control which memory content is affected. For example, the disclosure can be provoked with small sized ICMP echo requests sent to the device."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-459 Incomplete Cleanup"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://cert.vde.com/en-us/advisories/vde-2020-019",
              "refsource": "CONFIRM",
              "url": "https://cert.vde.com/en-us/advisories/vde-2020-019"
            }
          ]
        },
        "source": {
          "advisory": "VDE-2020-019",
          "discovery": "UNKNOWN"
        },
        "work_around": [
          {
            "lang": "en",
            "value": "If no real-time communication from TwinCAT is required on the Ethernet interface, then users can alternatively re-configure them to use the Intel \u00ae driver, which is shipped with Beckhoff images.\nCustomers should configure a perimeter firewall to block traffic from untrusted networks to the device, especially regarding ICMP and other small ethernet frames.\nBeckhoff offers software patches for TwinCAT 3.1 and TwinCAT 2.11 on request. These patches will be included in the the next regular releases to the affected software versions. The advisory will be updated upon availability."
          }
        ]
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
    "assignerShortName": "CERTVDE",
    "cveId": "CVE-2020-12494",
    "datePublished": "2020-06-16T13:28:38.000Z",
    "dateReserved": "2020-04-30T00:00:00.000Z",
    "dateUpdated": "2024-08-04T11:56:52.090Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted