Does the vulnerability CVE-2020-25159 affect any COPA-DATA products?

Does the vulnerability CVE-2020-25159 affect any COPA-DATA products?

Summary

A vulnerability has been reported in implementations of older versions of a specific Ethernet/IP stack from RTA (Realtime automation), that may still be used today.

The vulnerability has been rated critical, with a CVSSv3 score of 9.8.

The zenon logic K5BusEIPs / T5BusEIP - EIP adapter fieldbus driver makes use of the Ethernet/IP stack from RTA.

Description

A vulnerability has been reported in implementations of older versions of a specific Ethernet/IP stack from RTA (Realtime automation), that may still be used today.

The vulnerability has been rated critical, with a CVSSv3 score of 9.8.

The zenon logic K5BusEIPs / T5BusEIP - EIP adapter fieldbus driver makes use of the Ethernet/IP stack from RTA.

Solution

From version 7.50 (straton 9.0) and higher, where the K5BusEIP fieldbus driver is included, a newer version of the Ethernet/IP stack from RTA is in use, which is not affected by this vulnerability.

There may be OEM devices that make use of the straton runtime with a K5BusEIPs fieldbus driver that still make use of an older, vulnerable, version of the RTA Ethernet/IP stack.

In doubt, please contact your OEM device vendor.

Information

Further information can be found here:

https://www.claroty.com/2020/11/17/blog-research-rta-enip-stack-vulnerability/

ICSA-20-324-03

Real Time Automation EtherNet/IP | CISA

CVE-2020-25159

NVD - CVE-2020-25159 (nist.gov)



Issue Number: 232847
Fixed on Date: 17.11.2020
Versions: 8.20 0 BUILD 69649