High severity · published Apr 3, 2026
CVE-2020-37216
Hirschmann HiOS EtherNet/IP Stack Denial of Service
7.5
CVSS
0.9%
EPSS
No
On KEV
Description
Hirschmann HiOS devices versions prior to 08.1.00 and 07.1.01 contain a denial of service vulnerability in the EtherNet/IP stack where improper handling of packet length fields allows remote attackers to crash or hang the device. Attackers can send specially crafted UDP EtherNet/IP packets with a length value larger than the actual packet size to render the device inoperable.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HH
Hirschmann HiOS · Belden
05.00.00 through 08.0.00 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-37216
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-37216
assets.belden.com
https://assets.belden.com/m/3d3e2cbfa4860258/original/Belden-Security-Bulletin-BSECV-2019-14.pdf
www.vulncheck.com
https://www.vulncheck.com/advisories/hirschmann-hios-ethernet-ip-stack-denial-of-service
More from Hirschmann HiOS
9.8
CVE-2018-25236
Hirschmann HiOS HiSecOS Authentication Bypass via HTTP Management
9.8
CVE-2021-27734
Hirschmann HiOS 07.1.01, 07.1.02, and 08.1.00 through 08.5.xx and HiSecOS 03.3.00 through 03.5.01 allow remote attackers to change the credentials of existing users
9.8
CVE-2020-6994
A buffer overflow vulnerability was found in some devices of Hirschmann Automation and Control HiOS and HiSecOS
9.8
CVE-2019-12262
Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and 7 has Incorrect Access Control in the RARP client component
9.8
CVE-2019-12261
Wind River VxWorks 6.7 though 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 3 of 4)