Published:2020/07/31  Last Updated:2020/07/31

JVN#84959128
FANUC i Series CNC vulnerable to denial-of-service (DoS)

Overview

Fanuc i Series CNC contains a denial-of-service (DoS) vulnerability.

Products Affected

  • Embedded Ethernet 658M series
    • FANUC Series 30i/31i/32i-B Plus
    • FANUC Series 30i/31i/32i/35i-B
    • FANUC Power Motion i-MODEL A
  • Embedded Ethernet 658A series
    • FANUC Series 0i-MODEL F Plus
    • FANUC Series 0i-MODEL F
  • Embedded Ethernet 656E series
    • FANUC Series 30i/31i/32i-MODEL A
  • Embedded Ethernet 658E series
    • FANUC Series 0i-MODEL D
    • FANUC Series 0i-Mate D
  • Embedded Ethernet 656V series
    • FANUC Series 0i-MODEL C
  • Embedded Ethernet 656A series
    • FANUC Series 16i/18i/21i-MODEL B
    • FANUC Series 0i-MODEL B
  • Embedded Ethernet 656B series
    • FANUC Series 16i/18i-WB
For the details, refer to the information provided by the developer (Registered Users Only).

Description

Fanuc i Series CNC provided by FANUC CORPORATION contains a denial-of-service (DoS) (CWE-400) vulnerability.

Impact

A remote attacker may cause a denial-of-service (DoS) condition and access to the other devices may be blocked.

Solution

Update the software or apply the patch
The developer states that the updates/patches are available.
For the details, refer to the information provided by the developer (Registered Users Only).

Apply workaround
Applying the following workaround may mitigate the impact of this vulnerability.

  • Set up Firewall and restrict access from the devices via network.

Vendor Status

Vendor Link
FANUC CORPORATION FANUC Member's Site (Registered Users Only)

References

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

CVSS v3 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Base Score: 4.3
CVSS v2 AV:A/AC:L/Au:N/C:N/I:N/A:P
Base Score: 3.3

Credit

Industrial Control Security Laboratory of Qi An Xin Technology Group Inc. from China reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE CVE-2020-12739
JVN iPedia JVNDB-2020-000050

Update History

2020/07/31
Entered CVSS scores under the section [Vulnerability Analysis by JPCERT/CC]
2020/07/31
Added information under [Credit] section and fixed CVE ID under [Other Information] section.