CVE-2019-5637

Executive Summary

CVE-2019-5637 is a denial of service (DoS) vulnerability in the Beckhoff TwinCAT Profinet driver that allows an unauthenticated, network-adjacent attacker to crash the industrial controller by sending a single malformed UDP packet. The vulnerability affects TwinCAT 2 versions 2304 and prior, and TwinCAT 3.1 versions 4204.0 and prior. Given the Industrial Control System (ICS) context, a successful exploit can halt production processes, disrupt SCADA communications, and require manual controller restart, making this a critical availability concern for manufacturing environments using Beckhoff automation hardware.

Technical Analysis

The vulnerability exists in the Profinet driver component of Beckhoff TwinCAT, a widely-deployed industrial automation runtime used on Beckhoff IPC hardware for real-time control applications (PLC, motion control, HMI). The flaw is classified as a divide-by-zero condition — a CWE-369 class error (though CWE-ID is marked as N/A in the supplied data, the CNA title explicitly identifies the root cause).

A divide-by-zero in a driver context traditionally occurs when an attacker-controlled value is used as a divisor without proper validation. In the Profinet protocol, UDP packets encapsulate Profinet Runtime Protocol frames. Profinet's real-time (RT) and isochronous real-time (IRT) channels carry payloads that include length fields, cycle counters, or data block identifiers that may be passed to arithmetic operations within the driver's packet-processing path.

Attack surface: The Profinet driver listens on UDP ports (commonly the Profinet RT/IRT ports in the 0x8892 EtherType range, though the exact port is not specified in the NVD data). An unauthenticated packet sent directly to the device's network interface is sufficient — no session establishment, authentication, or prior knowledge of the controller's configuration is required.

Mechanism at the class level: When the driver parses a malformed UDP packet, one of its internal length or counter fields is zero or otherwise causes a division operation to produce an undefined result (integer divide-by-zero). On x86/x64 architectures, an integer divide-by-zero raises an arithmetic exception (INT 0 or #DE fault). Within a real-time kernel extension such as TwinCAT, this unhandled exception likely causes the TwinCAT runtime or the entire control kernel to fault, halting the PLC task loop and effectively freezing the controller.

It must be noted that the NVD description does not specify whether the malformed packet must target a specific TCP/UDP port, whether a specific Profinet sub-protocol (e.g., DCP, RT, IRT) is involved, or which exact field triggers the divide. Insufficient technical detail is available beyond the CNA title's root-cause classification.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class and the disclosed trigger conditions.

Step 1 — Reconnaissance / Target identification: An attacker on the OT network segment maps the Profinet topology. Standard ICS discovery tools (e.g., Nmap with Profinet DCP probing, or simply sniffing PROFINET DCP Hello frames) identify Beckhoff devices advertising TwinCAT and Profinet driver support. Devices using TwinCAT 2 ≤ 2304 or TwinCAT 3.1 ≤ 4204.0 with the Profinet driver enabled are the targets.

Step 2 — Trigger condition: The attacker crafts a UDP packet destined for the target device's IP address. The packet payload contains a malformed Profinet frame — specifically one that carries a field (e.g., a data length, frame counter, or similar numeric attribute) with a zero value in a position where the driver performs arithmetic division.

Step 3 — Payload / execution method: At the vulnerability-class level, the malformed frame causes a divide-by-zero arithmetic fault in the driver's parsing routine. Because the driver runs in the kernel or real-time context, the resulting exception is not recoverable by the application layer; it triggers a runtime fault that halts the PLC execution cycle.

Step 4 — Post-exploitation impact: The controller enters a fault/stop state. Outputs may go to a safe state depending on configured fallback behavior, but the control loop is halted, meaning no further process regulation occurs. Production line downtime is immediate. Recovery requires a manual restart of the TwinCAT runtime or a full controller reboot by an operator with physical or administrative access. Repeated packets cause repeated crashes, sustaining the DoS indefinitely.

If the attacker can also sniff valid Profinet traffic captured during step 1 reconnaissance, they can calculate valid frame parameters to make the malformed packet appear as legitimate as possible, potentially bypassing simple port/IP filters.

Impact Assessment

CVSS Score: 7.5 (High) — While the exact CVSS vector is N/A in the supplied data, a score of 7.5 on a 0–10 scale with no confidentiality or integrity impact typically corresponds to AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (High availability impact, network-exploitable, unauthenticated, no user interaction, in a single security context).

Business impact:

• Availability: The primary impact. A single packet halts the controller — an asset directly tied to physical process control.
• Production downtime: In manufacturing, food/beverage, automotive, or logistics environments, a halted PLC directly translates to stopped machines, conveyor systems, or process lines. Downtime costs are measured in dollars per minute.
• Safety implications: If the PLC controls safety-relevant actuators (valves, robotic cells) without proper failsafe design, an unexpected halt could create a hazardous state, though most systems are configured to go to a safe state on fault.
• Recovery cost: Manual controller restart requires OT personnel on-site; if the site is remote or unmanned, extended delays are possible.

Blast radius: Any organization running Beckhoff TwinCAT 2 ≤ v2304 or TwinCAT 3.1 ≤ v4204.0 with the Profinet driver active. Given Profinet's prevalence in European industrial automation and Beckhoff's market share in machine building and packaging, the affected population is substantial.

EPSS note: EPSS score of 0.01427 (70.5th percentile) indicates low immediate exploitation probability in the wild, but this does not diminish the severity for an OT environment where a single exploit incident is catastrophic.

Detection Guidance

Sigma Rule

title: Beckhoff TwinCAT Profinet Divide-by-Zero DoS - Malformed UDP
id: 5f8a2c3d-1b2e-4f7a-9d4c-b1e2f3a4b5c6
status: experimental
description: Detects malformed UDP packets targeting Beckhoff TwinCAT Profinet devices, potentially triggering CVE-2019-5637 divide-by-zero DoS.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2019-5637
author: Valtersit Threat Intelligence
date: 2024/01/15
logsource:
    category: network-connection
    product: zeek
detection:
    selection_profinet_udp:
        id.orig_p or id.resp_p:
            - 34964  # Typical Profinet UDP port (adjust per environment)
            - 49152
    selection_malformed:
        bytes_payload|lt: 60  # Abnormal Profinet frame size
    condition: selection_profinet_udp and selection_malformed
falsepositives:
    - Legitimate small Profinet DCP frames
level: high
tags:
    - attack.t1498
    - cve.2019.5637
    - ics.denial-of-service

YARA Rule

rule Beckhoff_TwinCAT_Profinet_DivideByZero_DoS {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects malformed UDP payload patterns targeting Beckhoff Profinet driver (CVE-2019-5637)"
        cve = "CVE-2019-5637"
        date = "2024-01-15"
        score = 60
    strings:
        // Profinet frame ID for RT packets often starts with 0x0100 range (not confirmed)
        // Look for DCP/RT frame identifiers with anomalous zero-length fields
        $profinet_rt = { 00 01 }  // Profinet RT frame marker (best-effort)
        $zero_len_field = { 00 00 } // Zero-length or zero-value counter pattern
        $profinet_dcp = { f0 00 }  // DCP identification request area (best-effort)
    condition:
        uint16(0) == 0x8892 or  // EtherType Profinet (layer 2)
        (uint16(0) == 0x0800 and $profinet_dcp) or  // IP/UDP variant
        ($profinet_rt and #zero_len_field > 3 and filesize < 200)
}

Suricata IDS Rule

alert udp any any -> any 34964 (msg:"ET SCAN Beckhoff TwinCAT Profinet Malformed UDP Attempt (CVE-2019-5637)"; flow:to_server; content:"|00 01|"; offset:0; depth:2; content:"|00 00|"; within:20; threshold:type both, track by_dst, count 3, seconds 60; reference:cve,2019-5637; classtype:attempted-dos; sid:2024567; rev:1;)

Note: Port 34964 is a commonly documented Profinet UDP port; however, the NVD description does not specify the exact port. Security teams should adjust the destination port to match their discovered Profinet traffic or run the rule without the port restriction.

Elastic Detection

sequence by source.ip with maxspan=1m
  [network where network.transport == "udp" and
   destination.port in (34964, 49152) and
   event.action == "connection_established"]
  [network where network.transport == "udp" and
   destination.port in (34964, 49152) and
   network.bytes < 100 and
   network.bytes > 0]

Splunk SPL Query

index=netflow OR index=packetbeat sourcetype="cisco:asa" OR sourcetype="pan:traffic"
| where transport="udp" AND (dest_port=34964 OR dest_port=49152)
| eval packet_size = len(_raw)
| where packet_size < 100
| stats count by src_ip, dest_ip, dest_port, _time
| where count > 1
| sort - _time
| table _time, src_ip, dest_ip, dest_port, count

Wazuh OSSEC Rule

<group name="ics,">
  <rule id="100567" level="12">
    <decoded_as>json</decoded_as>
    <field name="protocol">udp</field>
    <field name="dst_port" type="pcre2">^(34964|49152)$</field>
    <field name="bytes" type="pcre2">^([0-9]|[1-9][0-9])$</field> <!-- < 100 bytes -->
    <description>Malformed UDP packet to Beckhoff TwinCAT Profinet port - possible CVE-2019-5637 DoS</description>
    <group>ics_denial_of_service,</group>
    <mitre>
      <id>T1498</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed). No vendor fix version was provided in the supplied data. The below guidance applies an assumed patch path based on the affected version disclosures.

1) Immediate mitigations:

• Apply network segmentation: restrict UDP access to Profinet ports to only the PLC-to-PLC and PLC-to-IO-device subnets. Block all external/untrusted IP access to the control network segment.
• Deploy an OT firewall or IDS/IPS rule filtering unsolicited UDP traffic to Profinet ports from non-OT hosts.
• Disable the Profinet driver if not actively used; switch to a supported alternative fieldbus (e.g., EtherCAT) if operationally feasible.
• Deploy the detection rules above at the network perimeter to enable early alerting of malformed Profinet traffic.

2) Patch/upgrade steps:

• The CNA claims a patch exists; validate this directly with Beckhoff support. The fix will be delivered as a TwinCAT runtime update.
• Upgrading to TwinCAT 2 version 2304.1 or later or TwinCAT 3.1 version 4204.1 or later (or the vendor's declared fixed release) should include the divide-by-zero fix. Confirm the fixed version number with Beckhoff before deployment.
• Follow Beckhoff's standard update procedure: backup the project configuration, update the TwinCAT runtime on a test bench first, validate PLC code and Profinet communication under load, then roll out to production controllers during a scheduled maintenance window.
• Contact Beckhoff Product Security Incident Response Team (PSIRT) for the advisory document and fixed build numbers if not publicly available.

3) Long-term hardening:

• Implement zone-based OT network architecture following IEC 62443: separate the control network (Level 2) from any IT or external connectivity; DMZ all remote access.
• Restrict physical access to the OT network and controller cabinets.
• Maintain an inventory of all Beckhoff controllers and their TwinCAT versions to track patch compliance.
• Enable controller-level security features (where supported by the TwinCAT version): TLS/SSL for HMI/engineering traffic, and IP-based access control lists if the platform supports them.
• Monitor Beckhoff security advisories quarterly; ICS-CERT/ADLN (Automation and Control Solutions) advisories may contain additional CVE references for the same patch bundle.

References

1. NVD — https://nvd.nist.gov/vuln/detail/CVE-2019-5637
2. Beckhoff Product Security Advisory (referenced by the CNA — pull from Beckhoff support portal)
3. CISA ICS-CERT Advisories — https://www.cisa.gov/news-events/ics-advisories (search for Beckhoff TwinCAT)
4. Mitre ATT&CK for ICS — Technique T1498 (Network Denial of Service) — https://attack.mitre.org/techniques/T1498/

Known campaigns / exploitation in the wild: No public evidence of a specific threat actor campaign leveraging CVE-2019-5637 was identified. The CISA KEV catalog does not include this CVE, and no exploit code is publicly available. The EPSS percentile (70.5%) suggests some prior interest/discussion, but exploitation remains unconfirmed.

Report generated by Valtersit Threat Intelligence. This document is for defensive security purposes only.