CVE-2017-6023
📋 TL;DR
A stack-based buffer overflow vulnerability in Fatek Automation PLC Ethernet Module configuration software allows remote attackers to execute arbitrary code or crash affected PLC devices. This affects industrial control systems using specific Fatek PLC models with vulnerable Ether_cfg software versions. Organizations using these PLCs in critical infrastructure are at risk.
💻 Affected Systems
- Fatek PLC Ethernet Module
- Ether_cfg configuration software
📦 What is this software?
Ethernet Module Configuration Tool Cbe Firmware by Fatek
View all CVEs affecting Ethernet Module Configuration Tool Cbe Firmware →
Ethernet Module Configuration Tool Cbeh Firmware by Fatek
View all CVEs affecting Ethernet Module Configuration Tool Cbeh Firmware →
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete compromise of PLC, potential manipulation of industrial processes, physical damage, or safety incidents.
Likely Case
PLC crash causing operational disruption in industrial processes, requiring manual restart and potential production downtime.
If Mitigated
Limited impact if PLCs are isolated in air-gapped networks with proper segmentation and access controls.
🎯 Exploit Status
Buffer overflow vulnerabilities typically have low exploitation complexity, especially with CVSS 9.8 score indicating minimal attack requirements.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: V3.6 Build 170215 or later
Vendor Advisory: https://ics-cert.us-cert.gov/advisories/ICSA-17-073-01
Restart Required: Yes
Instructions:
1. Download updated Ether_cfg software version V3.6 Build 170215 or later from Fatek. 2. Install the update on all Windows systems running Ether_cfg. 3. Restart the Ether_cfg software and connected PLCs. 4. Verify all PLCs are running updated firmware.
🔧 Temporary Workarounds
Network Segmentation
allIsolate PLC networks from corporate and internet networks using firewalls with strict access controls.
Access Restriction
allRestrict network access to Ether_cfg software ports (typically TCP 502 for Modbus) to authorized management systems only.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate vulnerable PLCs from untrusted networks
- Deploy intrusion detection systems to monitor for exploitation attempts on PLC networks
🔍 How to Verify
Check if Vulnerable:
Check Ether_cfg software version in Help > About menu. If version is prior to V3.6 Build 170215, system is vulnerable.Check Version:
No command-line option; check via Ether_cfg GUI Help > About menuVerify Fix Applied:
Verify Ether_cfg software shows version V3.6 Build 170215 or later in Help > About menu.📡 Detection & Monitoring
Log Indicators:
- Unexpected Ether_cfg software crashes
- PLC communication failures
- Multiple connection attempts to PLC ports
Network Indicators:
- Unusual traffic to TCP port 502 (Modbus) or other PLC communication ports
- Malformed packets to Ether_cfg services
SIEM Query:
source="plc_network" AND (dest_port=502 OR dest_port=[plc_ports]) AND (bytes>threshold OR pattern="buffer_overflow")