# Festo SBRD-Q/SBOC-Q/SBOI-Q EtherNet/IP RCE vulnerabilities

Published: 2025-09-30 · Severity: routine · Sectors: manufacturing
Canonical: https://vorant.io/reports/f9269409-1bed-5303-9fcb-309bc8248ff1/festo-sbrd-q-sboc-q-sboi-q-ethernet-ip-rce-vulnerabilities

> Four remotely-exploitable flaws in Festo industrial controllers allow data exfiltration and denial-of-service; no fix planned.

CISA has issued a notice on four vulnerabilities affecting Festo SBRD-Q, SBOC-Q, and SBOI-Q industrial controllers across all firmware versions. The flaws reside in the EtherNet/IP stack implementation and can be triggered by specially-crafted packets sent remotely with no authentication required. CVE-2021-27478 (incorrect numeric conversion, CVSS 8.2) and CVE-2021-27500/CVE-2021-27498 (reachable assertions, CVSS 7.5 each) cause denial-of-service conditions; CVE-2021-27482 (out-of-bounds read, CVSS 7.5) permits arbitrary data exfiltration. The vulnerabilities affect multiple hardware revisions of these controllers deployed worldwide in critical manufacturing environments.

Festo has not released patches and has indicated no fix is planned. The advisories recommend network isolation, disabling EtherNet/IP if unused, and implementing firewall protections. CISA reports no known active exploitation in the wild at the time of publication. Organizations relying on these controllers should prioritize network segmentation and access control to limit exposure.

## Mentioned in this report

- Vulnerabilities: CVE-2021-27478, CVE-2021-27482, CVE-2021-27498, CVE-2021-27500

## Detection guidance (public sample)

### External Source Connecting to EtherNet/IP Port (44818 or 2222)

ATT&CK: T1190

Allowed traffic from a non-private source address to EtherNet/IP ports 44818 or 2222, which is the exposure path for the unauthenticated crafted-packet flaws in Festo SBRD-Q/SBOC-Q/SBOI-Q controllers. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: External Source Connecting to EtherNet/IP Port (44818 or 2222)
id: 3e4b5159-c7dc-551f-9a50-3af83f20253b
status: experimental
description: Detects allowed firewall traffic from a non-private source address to
  EtherNet/IP ports (TCP/UDP 44818, UDP 2222). The Festo controller flaws are triggered
  by unauthenticated crafted EtherNet/IP packets, so any internet-sourced access to
  these ports is a likely exploitation or reconnaissance path. Tune the destination
  scope to your ICS network segments.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-273-02
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: firewall
detection:
  selection:
    dst_port:
    - 44818
    - 2222
    action:
    - allowed
    - allow
    - accept
    - permitted
  filter_private_src:
    src_ip|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
    - 127.0.0.0/8
    - 169.254.0.0/16
  condition: selection and not filter_private_src
falsepositives:
- Authorised remote vendor support or cloud-hosted SCADA/historian systems that legitimately
  reach controllers over EtherNet/IP
- Partner or integrator networks using public address space to reach the OT segment
level: high
author: Vorant
```

### Scripting or Scanning Tool Connecting to EtherNet/IP Port 44818

ATT&CK: T1190

A scripting runtime or network tool on a Windows host opening connections to TCP 44818, which suggests crafted EtherNet/IP packets or scanning against industrial controllers. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Scripting or Scanning Tool Connecting to EtherNet/IP Port 44818
id: 5927f39c-ff5b-55d4-b766-0fd623663877
status: experimental
description: Detects general-purpose scripting or network tools (Python, PowerShell,
  nmap, ncat) initiating outbound connections to TCP port 44818 (EtherNet/IP). Crafted-packet
  exploitation of the Festo SBRD-Q/SBOC-Q/SBOI-Q EtherNet/IP stack would require such
  tooling, as industrial engineering software normally uses its own signed binaries.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-273-02
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    DestinationPort: 44818
    Image|endswith:
    - \python.exe
    - \pythonw.exe
    - \powershell.exe
    - \pwsh.exe
    - \nmap.exe
    - \ncat.exe
    - \nc.exe
  condition: selection
falsepositives:
- OT engineers running Python-based EtherNet/IP tooling (for example pycomm3 scripts)
  for diagnostics
- Authorised vulnerability scanners run from Windows assessment hosts
level: medium
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-273-02

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/f9269409-1bed-5303-9fcb-309bc8248ff1/festo-sbrd-q-sboc-q-sboi-q-ethernet-ip-rce-vulnerabilities.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup