Festo SBRD-Q/SBOC-Q/SBOI-Q EtherNet/IP RCE vulnerabilities
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Four remotely-exploitable flaws in Festo industrial controllers allow data exfiltration and denial-of-service; no fix planned.
CISA has issued a notice on four vulnerabilities affecting Festo SBRD-Q, SBOC-Q, and SBOI-Q industrial controllers across all firmware versions. The flaws reside in the EtherNet/IP stack implementation and can be triggered by specially-crafted packets sent remotely with no authentication required. CVE-2021-27478 (incorrect numeric conversion, CVSS 8.2) and CVE-2021-27500/CVE-2021-27498 (reachable assertions, CVSS 7.5 each) cause denial-of-service conditions; CVE-2021-27482 (out-of-bounds read, CVSS 7.5) permits arbitrary data exfiltration. The vulnerabilities affect multiple hardware revisions of these controllers deployed worldwide in critical manufacturing environments.
Festo has not released patches and has indicated no fix is planned. The advisories recommend network isolation, disabling EtherNet/IP if unused, and implementing firewall protections. CISA reports no known active exploitation in the wild at the time of publication. Organizations relying on these controllers should prioritize network segmentation and access control to limit exposure.
Mentioned in this report
Detection guidance
External Source Connecting to EtherNet/IP Port (44818 or 2222)
Allowed traffic from a non-private source address to EtherNet/IP ports 44818 or 2222, which is the exposure path for the unauthenticated crafted-packet flaws in Festo SBRD-Q/SBOC-Q/SBOI-Q controllers. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: External Source Connecting to EtherNet/IP Port (44818 or 2222)
id: 3e4b5159-c7dc-551f-9a50-3af83f20253b
status: experimental
description: Detects allowed firewall traffic from a non-private source address to
EtherNet/IP ports (TCP/UDP 44818, UDP 2222). The Festo controller flaws are triggered
by unauthenticated crafted EtherNet/IP packets, so any internet-sourced access to
these ports is a likely exploitation or reconnaissance path. Tune the destination
scope to your ICS network segments.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-273-02
tags:
- attack.initial-access
- attack.t1190
logsource:
category: firewall
detection:
selection:
dst_port:
- 44818
- 2222
action:
- allowed
- allow
- accept
- permitted
filter_private_src:
src_ip|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
- 127.0.0.0/8
- 169.254.0.0/16
condition: selection and not filter_private_src
falsepositives:
- Authorised remote vendor support or cloud-hosted SCADA/historian systems that legitimately
reach controllers over EtherNet/IP
- Partner or integrator networks using public address space to reach the OT segment
level: high
author: Vorant
Scripting or Scanning Tool Connecting to EtherNet/IP Port 44818
A scripting runtime or network tool on a Windows host opening connections to TCP 44818, which suggests crafted EtherNet/IP packets or scanning against industrial controllers. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Scripting or Scanning Tool Connecting to EtherNet/IP Port 44818
id: 5927f39c-ff5b-55d4-b766-0fd623663877
status: experimental
description: Detects general-purpose scripting or network tools (Python, PowerShell,
nmap, ncat) initiating outbound connections to TCP port 44818 (EtherNet/IP). Crafted-packet
exploitation of the Festo SBRD-Q/SBOC-Q/SBOI-Q EtherNet/IP stack would require such
tooling, as industrial engineering software normally uses its own signed binaries.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-273-02
tags:
- attack.initial-access
- attack.t1190
logsource:
category: network_connection
product: windows
detection:
selection:
Initiated: 'true'
DestinationPort: 44818
Image|endswith:
- \python.exe
- \pythonw.exe
- \powershell.exe
- \pwsh.exe
- \nmap.exe
- \ncat.exe
- \nc.exe
condition: selection
falsepositives:
- OT engineers running Python-based EtherNet/IP tooling (for example pycomm3 scripts)
for diagnostics
- Authorised vulnerability scanners run from Windows assessment hosts
level: medium
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-273-02
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs