CVE-2020-12494

Beckhoff's TwinCAT RT network driver for Intel 8254x and 8255x is providing EtherCAT functionality. The driver implements real-time features. Except for Ethernet frames sent from real-time functionality, all other Ethernet frames sent through the driver are not padded if their payload is less than the minimum Ethernet frame size. Instead, arbitrary memory content is transmitted within in the padding bytes of the frame. Most likely this memory contains slices from previously transmitted or received frames. By this method, memory content is disclosed, however, an attacker can hardly control which memory content is affected. For example, the disclosure can be provoked with small sized ICMP echo requests sent to the device.

• CWE-459
• CWE-459

• https://cert.vde.com/en-us/advisories/vde-2020-019Third Party Advisory
• https://cert.vde.com/en-us/advisories/vde-2020-019Third Party Advisory

Published

Jun 16, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-12487Due to the flaws in the verification of input parameters, th…7
• CVE-2020-12488The attacker can access the sensitive information stored wit…5.5
• CVE-2020-1249An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-12491Improper control of framework service permissions with possi…4.8
• CVE-2020-12492Improper handling of WiFi information by framework services …1
• CVE-2020-12493An open port used for debugging in SWARCOs CPU LS4000 Series…10
• CVE-2020-12495Endress+Hauser Ecograph T (Neutral/Private Label) (RSG35, OR…8.8
• CVE-2020-12496Endress+Hauser Ecograph T (Neutral/Private Label) (RSG35, OR…6.5
• CVE-2020-12497PLCopen XML file parsing in Phoenix Contact PC Worx and PC W…7.8
• CVE-2020-12498mwe file parsing in Phoenix Contact PC Worx and PC Worx Expr…7.8
• CVE-2020-12499In PHOENIX CONTACT PLCnext Engineer version 2020.3.1 and ear…7.3
• CVE-2020-1250<p>An information disclosure vulnerability exists when the w…5.5