CVE-2021-27498 - OpenCVE

A specifically crafted packet sent by an attacker to EIPStackGroup OpENer EtherNet/IP commits and versions prior to Feb 10, 2021 may result in a denial-of-service condition.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

AV:N/AC:L/Au:N/C:N/I:N/A:P

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Opener Project	Opener

Configuration 1 [-]

cpe:2.3:a:opener_project:opener:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/EIPStackGroup/OpENer
https://www.cisa.gov/uscert/ics/advisories/icsa-21-105-02

History

No history.

MITRE

Status: PUBLISHED

Assigner: icscert

Published: 2022-05-12T19:18:38

Updated: 2024-08-03T21:26:09.033Z

Reserved: 2021-02-19T00:00:00

Link: CVE-2021-27498

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2022-05-12T20:15:13.843

Modified: 2022-05-23T15:15:58.633

Link: CVE-2021-27498

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "OpENer EtherNet/IP", "vendor": "EIPStackGroup", "versions": [{"lessThan": "Feb 10, 2021", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Tal Keren and Sharon Brizinov of Claroty reported these vulnerabilities to CISA."}], "descriptions": [{"lang": "en", "value": "A specifically crafted packet sent by an attacker to EIPStackGroup OpENer EtherNet/IP commits and versions prior to Feb 10, 2021 may result in a denial-of-service condition."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-617", "description": "CWE-617: Reachable Assertion", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-05-12T19:18:38", "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-105-02"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/EIPStackGroup/OpENer"}], "solutions": [{"lang": "en", "value": "The maintainer of OpENer recommends those affected to apply the latest commits available."}], "source": {"discovery": "EXTERNAL"}, "title": "EIPStackGroup OpENer Ethernet/IP Reachable Assertion", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "ics-cert@hq.dhs.gov", "ID": "CVE-2021-27498", "STATE": "PUBLIC", "TITLE": "EIPStackGroup OpENer Ethernet/IP Reachable Assertion"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "OpENer EtherNet/IP", "version": {"version_data": [{"version_affected": "<", "version_value": "Feb 10, 2021"}]}}]}, "vendor_name": "EIPStackGroup"}]}}, "credit": [{"lang": "eng", "value": "Tal Keren and Sharon Brizinov of Claroty reported these vulnerabilities to CISA."}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A specifically crafted packet sent by an attacker to EIPStackGroup OpENer EtherNet/IP commits and versions prior to Feb 10, 2021 may result in a denial-of-service condition."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-617: Reachable Assertion"}]}]}, "references": {"reference_data": [{"name": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-105-02", "refsource": "CONFIRM", "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-105-02"}, {"name": "https://github.com/EIPStackGroup/OpENer", "refsource": "CONFIRM", "url": "https://github.com/EIPStackGroup/OpENer"}]}, "solution": [{"lang": "en", "value": "The maintainer of OpENer recommends those affected to apply the latest commits available."}], "source": {"discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T21:26:09.033Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-105-02"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/EIPStackGroup/OpENer"}]}]}, "cveMetadata": {"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "assignerShortName": "icscert", "cveId": "CVE-2021-27498", "datePublished": "2022-05-12T19:18:38", "dateReserved": "2021-02-19T00:00:00", "dateUpdated": "2024-08-03T21:26:09.033Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:opener_project:opener:*:*:*:*:*:*:*:*", "matchCriteriaId": "1EE035AE-99DF-4AA0-B75F-679A6F57C194", "versionEndIncluding": "2.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A specifically crafted packet sent by an attacker to EIPStackGroup OpENer EtherNet/IP commits and versions prior to Feb 10, 2021 may result in a denial-of-service condition."}, {"lang": "es", "value": "Un paquete espec\u00edficamente dise\u00f1ado enviado por un atacante a EIPStackGroup OpENer EtherNet/IP commits y versiones anteriores a 10 de febrero de 2021, puede resultar en una situaci\u00f3n de denegaci\u00f3n de servicio"}], "id": "CVE-2021-27498", "lastModified": "2022-05-23T15:15:58.633", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}, "published": "2022-05-12T20:15:13.843", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory"], "url": "https://github.com/EIPStackGroup/OpENer"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-105-02"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-617"}], "source": "ics-cert@hq.dhs.gov", "type": "Primary"}]}