CVE-2020-9307

Severity Score

6.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Hirschmann OS2, RSP, and RSPE devices before HiOS 08.3.00 allow a denial of service. An unauthenticated, adjacent attacker can cause an infinite loop on one of the HSR ring ports of the device. This effectively breaks the redundancy of the HSR ring. If the attacker can perform the same attack on a second device, the ring is broken into two parts (thus disrupting communication between devices in the different parts).

Los dispositivos Hirschmann OS2, RSP y RSPE anteriores a HiOS versiones 08.3.00, permiten una denegación de servicio. Un atacante adyacente no autenticado puede causar un bucle infinito en uno de los puertos de anillo HSR del dispositivo. Esto efectivamente rompe la redundancia del anillo HSR. Si el atacante puede llevar a cabo el mismo ataque en un segundo dispositivo, el anillo es partido en dos partes (interrumpiendo así la comunicación entre dispositivos en las diferentes partes)

*Credits: N/A

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Attack Vector

Adjacent

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

None

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2020-02-19 CVE Reserved
2021-02-11 CVE Published
2023-10-28 EPSS Updated
2024-08-04 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')

CAPEC

References (2)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://www.belden.com/dfsmedia/f1e38517e0cd4caa8b1acb6619890f5e/12276-source/options/view	2021-02-23
https://www.belden.com/security	2021-02-23

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Belden Search vendor "Belden"		Hirschmann Hios Search vendor "Belden" for product "Hirschmann Hios"				>= 07.0.04 < 07.1.00 Search vendor "Belden" for product "Hirschmann Hios" and version " >= 07.0.04 < 07.1.00"		-		Affected
Belden Search vendor "Belden"		Hirschmann Hios Search vendor "Belden" for product "Hirschmann Hios"				>= 08.0.00 < 08.3.00 Search vendor "Belden" for product "Hirschmann Hios" and version " >= 08.0.00 < 08.3.00"		-		Affected