Description
An issue in the NetStaX EtherNet/IP Stack prior to v5.6.1 could allow a large Class 3 explicit-message request to exceed the application-side receive buffer without generating an error or warning. The result could be memory corruption, a device crash, or a potential remote attack vector without the originating device receiving a CIP error indicating that the request could not be processed.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Pyramid Solutions EtherNet/IP Adapter DLL Kit (EIPA)
Default version status: unaffected
0 to ≤ v5.6.1affectedv5.6.1unaffected
Pyramid Solutions EtherNet/IP Adapter DLL Kit with CIP Security (EIPA-SECURE)
Default version status: unaffected
0 to ≤ v5.6.1affectedv5.6.1unaffected
Pyramid Solutions EtherNet/IP Adapter Development Kit (EADK)
Default version status: unaffected
0 to ≤ v5.6.1affectedv5.6.1unaffected
Pyramid Solutions EtherNet/IP Adapter Development Kit with CIP Security (EADK-SECURE)
Default version status: unaffected
0 to ≤ v5.6.1affectedv5.6.1unaffected
Pyramid Solutions EtherNet/IP Scanner DLL Kit (EIPS)
Default version status: unaffected
0 to ≤ v5.6.1affectedv5.6.1unaffected
Pyramid Solutions EtherNet/IP Scanner DLL Kit with CIP Security (EIPS-SECURE)
Default version status: unaffected
0 to ≤ v5.6.1affectedv5.6.1unaffected
Pyramid Solutions EtherNet/IP Scanner Development Kit (ESDK)
Default version status: unaffected
0 to ≤ v5.6.1affectedv5.6.1unaffected
Pyramid Solutions EtherNet/IP Scanner Development Kit with CIP Security (ESDK-SECURE)
Default version status: unaffected
0 to < v5.6.1affectedv5.6.1unaffected