CVE-2020-37216: Hirschmann HiOS EtherNet/IP DoS Flaw

CVE-2020-37216 Overview

CVE-2020-37216 is a denial of service vulnerability affecting Hirschmann HiOS devices running firmware versions prior to 08.1.00 and 07.1.01. The vulnerability exists in the EtherNet/IP stack where improper handling of packet length fields allows remote attackers to crash or hang the device. Attackers can send specially crafted UDP EtherNet/IP packets with a length value larger than the actual packet size to render the device inoperable, potentially disrupting critical industrial control systems and network infrastructure.

Critical Impact

Remote unauthenticated attackers can render Hirschmann HiOS industrial networking devices completely inoperable by sending malformed UDP packets, potentially causing widespread disruption to industrial control system networks.

Affected Products

• Hirschmann HiOS devices with firmware versions prior to 08.1.00
• Hirschmann HiOS devices with firmware versions prior to 07.1.01
• Industrial Ethernet switches and devices running vulnerable HiOS firmware

Discovery Timeline

• 2026-04-03 - CVE CVE-2020-37216 published to NVD
• 2026-04-07 - Last updated in NVD database

Technical Details for CVE-2020-37216

Vulnerability Analysis

This vulnerability stems from improper input validation (CWE-20) within the EtherNet/IP protocol stack implementation on Hirschmann HiOS devices. The EtherNet/IP protocol is widely used in industrial automation environments for real-time control and data exchange between industrial devices.

The flaw occurs when the device processes UDP packets containing EtherNet/IP encapsulation. The protocol stack fails to properly validate that the declared length field in incoming packets matches the actual received packet size. When an attacker sends a packet with a length value exceeding the actual payload size, the device's processing logic attempts to read beyond the received data boundaries, leading to undefined behavior that causes the device to crash or enter a hung state.

This is a network-accessible vulnerability requiring no authentication or user interaction, making it particularly dangerous in industrial environments where these devices manage critical infrastructure. The attack can be executed remotely by any attacker with network access to the vulnerable device's EtherNet/IP service, typically listening on UDP port 44818.

Root Cause

The root cause is improper input validation in the EtherNet/IP stack's packet parsing routine. The firmware fails to verify that the declared packet length field corresponds to the actual amount of data received in the UDP datagram. This absence of boundary checking allows specially crafted packets to trigger buffer over-read conditions or other memory access violations that crash the device's operating system or cause it to become unresponsive.

Attack Vector

The attack vector is network-based, allowing remote exploitation without authentication. An attacker can craft malicious UDP packets targeting the EtherNet/IP service (typically UDP port 44818) on vulnerable Hirschmann HiOS devices. The attack involves:

1. Identifying a target Hirschmann HiOS device on the network
2. Crafting a UDP packet with EtherNet/IP encapsulation containing a length field value larger than the actual packet data
3. Sending the malformed packet to the device's EtherNet/IP service port
4. The device processes the packet, attempts to read beyond available data, and crashes or hangs

The vulnerability is particularly severe in industrial control system (ICS) environments where network switches are critical infrastructure components. A successful attack can cause network segmentation failures and disrupt communication between industrial controllers and field devices. For detailed technical information, refer to the Belden Security Bulletin BSECV-2019-14 and the VulnCheck Advisory on Hirschmann DoS.

Detection Methods for CVE-2020-37216

Indicators of Compromise

• Unexpected device reboots or unresponsive Hirschmann HiOS network devices
• Sudden network connectivity loss in segments managed by Hirschmann switches
• Increased UDP traffic on port 44818 (EtherNet/IP) with malformed packets
• Device logs showing crash events or watchdog timer resets

Detection Strategies

• Monitor EtherNet/IP traffic (UDP port 44818) for packets where declared length exceeds actual packet size
• Implement network-based intrusion detection rules to flag anomalous EtherNet/IP packet structures
• Deploy deep packet inspection on network segments containing vulnerable Hirschmann devices
• Configure SIEM alerts for repeated device unavailability events on HiOS infrastructure

Monitoring Recommendations

• Enable syslog forwarding from Hirschmann devices to centralized logging infrastructure
• Monitor device uptime metrics and alert on unexpected reboot patterns
• Implement network traffic baselining for EtherNet/IP communications
• Use industrial protocol-aware network monitoring tools to detect protocol anomalies

How to Mitigate CVE-2020-37216

Immediate Actions Required

• Upgrade Hirschmann HiOS devices to firmware version 08.1.00 or later (or 07.1.01 for the 07.x branch)
• Restrict network access to EtherNet/IP services using firewall rules and network segmentation
• Isolate vulnerable devices on dedicated network segments with strict access controls
• Implement network monitoring to detect exploitation attempts targeting UDP port 44818

Patch Information

Belden, the parent company of Hirschmann, has released firmware updates to address this vulnerability. Organizations should upgrade affected HiOS devices to version 08.1.00 or later (or 07.1.01 for devices on the 07.x firmware branch). The Belden Security Bulletin BSECV-2019-14 provides official guidance on obtaining and applying the security patches.

Workarounds

• Disable EtherNet/IP protocol on devices where it is not required for operational purposes
• Implement network segmentation to restrict access to vulnerable devices from untrusted networks
• Deploy industrial firewalls or access control lists to block unauthorized access to UDP port 44818
• Use VPN or other secure access methods for remote management of industrial networks

# Example firewall rule to restrict EtherNet/IP access (adapt for your firewall platform)
# Block external access to EtherNet/IP UDP port
iptables -A INPUT -p udp --dport 44818 -s ! 10.0.0.0/8 -j DROP
# Allow only trusted management networks
iptables -A INPUT -p udp --dport 44818 -s 10.10.10.0/24 -j ACCEPT