« Volver al listado

CVE-2023-7243

Estado: ModificadaCrítica (9.8)—

Industrial Control Systems Network Protocol Parsers (ICSNPP) - Ethercat Zeek Plugin versions d78dda6 and prior are vulnerable to out-of-bounds write while analyzing specific Ethercat datagrams. This could allow an attacker to cause arbitrary code execution.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Cisa — Icsnpp-ethercat

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-7243",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-7243",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-03-04T14:43:10.655479Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "ics-cert@hq.dhs.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "ics-cert@hq.dhs.gov",
      "affectedData": [
        {
          "vendor": "CISA",
          "product": "Industrial Control Systems Network Protocol Parsers (ICSNPP) - Ethercat Plugin for Zeek",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "d78dda6"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:cisa:icsnpp-ethercat:*:*:*:*:*:zeek:*:*"
          ],
          "vendor": "cisa",
          "product": "icsnpp-ethercat",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "d78dda6",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-03-01T21:15:07.417",
  "references": [
    {
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-051-02",
      "tags": [
        "US Government Resource",
        "Vendor Advisory"
      ],
      "source": "ics-cert@hq.dhs.gov"
    },
    {
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-051-02",
      "tags": [
        "US Government Resource",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "ics-cert@hq.dhs.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "\nIndustrial Control Systems Network Protocol Parsers (ICSNPP) - Ethercat \nZeek Plugin versions d78dda6 and prior are vulnerable to out-of-bounds \nwrite while analyzing specific Ethercat datagrams. This could allow an \nattacker to cause arbitrary code execution.\n\n\n\n"
    },
    {
      "lang": "es",
      "value": "Industrial Control Systems Network Protocol Parsers (ICSNPP): las versiones d78dda6 y anteriores del complemento Ethercat Zeek son vulnerables a escritura fuera de los límites al analizar datagramas Ethercat específicos. Esto podría permitir que un atacante provoque la ejecución de código arbitrario."
    }
  ],
  "lastModified": "2026-06-17T06:52:23.670",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cisa:icsnpp-ethercat:*:*:*:*:*:zeek:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D713D8FB-83DA-4BA8-87B2-CEB65DB5BBFE",
              "versionEndIncluding": "d78dda6"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "ics-cert@hq.dhs.gov"
}