CVE-2021-32998

high-risk

Published 2022-01-10

The FANUC R-30iA and R-30iB series controllers are vulnerable to an out-of-bounds write, which may allow an attacker to remotely execute arbitrary code. INIT START/restore from backup required.

Do I need to act?

-

0.39% chance of exploitation

EPSS score — low exploit probability

-

Not on CISA KEV list

No confirmed active exploitation reported to CISA

?

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

7

CVSS 7.4/10 High

NETWORK / HIGH complexity

Affected Products (20)

R-30Ia Firmware

R-30Ia Firmware

R-30Ia Firmware

R-30Ia Firmware

R-30Ia Firmware

R-30Ia Firmware

R-30Ia Firmware

R-30Ia Mate Firmware

R-30Ia Mate Firmware

R-30Ia Mate Firmware

R-30Ia Mate Firmware

R-30Ia Mate Firmware

R-30Ia Mate Firmware

R-30Ia Mate Firmware

R-30Ib Mate Firmware

R-30Ib Mate Firmware

R-30Ib Mate Firmware

R-30Ib Mate Firmware

R-30Ib Mate Firmware

R-30Ib Mate Firmware

Affected Vendors

Fanuc

References (2)

Third Party Advisory https://www.cisa.gov/uscert/ics/advisories/icsa-21-243-02

Third Party Advisory https://www.cisa.gov/uscert/ics/advisories/icsa-21-243-02

50

/ 100

high-risk

Severity 22/34 · High

Exploitability 1/34 · Minimal

Exposure 27/34 · High