CVE-2017-6023
Critical
Description
An issue was discovered in Fatek Automation PLC Ethernet Module. The affected Ether_cfg software configuration tool runs on the following Fatek PLCs: CBEH versions prior to V3.6 Build 170215, CBE versions prior to V3.6 Build 170215, CM55E versions prior to V3.6 Build 170215, and CM25E versions prior to V3.6 Build 170215. A stack-based buffer overflow vulnerability has been identified, which may allow remote code execution or crash the affected device.
SeverityCritical
CVSS9.8
Exploit probability—
ProductFatek Ethernet Module Configuration Tool Cbe Firmware
PublishedMar 16, 2017
First seenMar 16, 2017
Weakness typeCWE-121CWE-121
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fatek ethernet_module_configuration_tool_cbe_firmware | v ≤ 3.5 | — |
| fatek ethernet_module_configuration_tool_cbeh_firmware | v ≤ 3.5 | — |
| fatek ethernet_module_configuration_tool_cm25e_firmware | v ≤ 3.5 | — |
| fatek ethernet_module_configuration_tool_cm55e_firmware | v ≤ 3.5 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.