CVE-2020-18731
📋 TL;DR
A NULL pointer dereference vulnerability in IEC104 v1.0 allows attackers to cause a denial of service via segmentation violation. This affects systems using the IEC 60870-5-104 protocol implementation for industrial control systems. Attackers can crash the service by sending specially crafted packets.
💻 Affected Systems
- IEC104 protocol implementation v1.0
📦 What is this software?
Iec104 by Iec104 Project
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption of IEC104 protocol communication, potentially affecting industrial control system operations and causing downtime in critical infrastructure.
Likely Case
Service crash requiring manual restart, disrupting IEC104 communication until service is restored.
If Mitigated
Minimal impact with proper network segmentation and monitoring; service can be quickly restored if automated.
🎯 Exploit Status
Simple packet manipulation can trigger the NULL pointer dereference. Public GitHub issue shows exploitation details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified
Vendor Advisory: No official vendor advisory found
Restart Required: Yes
Instructions:
1. Check if using IEC104 v1.0 implementation. 2. Monitor GitHub repository for patches. 3. Consider alternative implementations if available. 4. Apply workarounds immediately.
🔧 Temporary Workarounds
Network Segmentation
allIsolate IEC104 systems from untrusted networks using firewalls and VLANs.
Traffic Filtering
allImplement network filtering to block malformed IEC104 packets at perimeter.
🧯 If You Can't Patch
- Implement strict network access controls to limit who can communicate with IEC104 systems.
- Deploy intrusion detection systems monitoring for IEC104 protocol anomalies and DoS attempts.
🔍 How to Verify
Check if Vulnerable:
Check if using IEC104 v1.0 implementation from the affected repository. Review system logs for segmentation faults related to IEC104 service.Check Version:
Check application version or repository source to confirm IEC104 v1.0 usage.Verify Fix Applied:
Monitor for absence of segmentation faults in IEC104 service logs after implementing controls.📡 Detection & Monitoring
Log Indicators:
- Segmentation fault errors in IEC104 service logs
- Service crash/restart events
- Abnormal termination of IEC104 process
Network Indicators:
- Malformed IEC104 packets
- Unexpected traffic spikes to IEC104 port (typically 2404)
- Protocol violations in IEC104 communication
SIEM Query:
source="iec104.log" AND ("segmentation fault" OR "SIGSEGV" OR "crash")