CVE-2023-7242 is an out-of-bounds read in the ICSNPP Ethercat plugin for Zeek. A specific EtherCAT packet can crash the Zeek process and leak some memory contents. It scores 8.2 (High). Plugin commits d78dda6 and earlier are affected, and CISA advises commit 3bca34c or later.
What's affected
Affected: the Industrial Control Systems Network Protocol Parsers (ICSNPP) Ethercat plugin for Zeek, at commit d78dda6 and prior. Fixed: update to commit 3bca34c or later, per CISA advisory ICSA-24-051-02. The plugin is published as GitHub commits, not numbered releases, so versions are commit hashes.
The advisory covers three CVEs in the same plugin: CVE-2023-7243 and CVE-2023-7244 (out-of-bounds writes, each 9.8) and CVE-2023-7242 (out-of-bounds read, 8.2). One update fixes all three. KEV is false for each, and the advisory does not describe exploitation in the wild. CISA credits the report to a researcher at HACK@UCF.
This entry is the read flaw. The weakness is CWE-125, out-of-bounds read. The vector is network reachable with no privileges, low confidentiality impact, no integrity impact and high availability impact. The first two CVEs in the advisory are the more severe write flaws.
How to check if you're exposed
If you installed the plugin from source or through the Zeek package manager, find the cloned directory and check the commit.
cd /path/to/icsnpp-ethercat
git log --oneline -1
git merge-base --is-ancestor 3bca34c HEAD && echo has-fix || echo missing-fix
If it prints missing-fix, you are on a vulnerable commit. If you manage Zeek sensors in bulk, add this check to your sensor configuration review.
What to do now
- Update the ICSNPP Ethercat plugin to commit 3bca34c or later and restart Zeek.
- Inventory every Zeek sensor that loads the plugin, including lab and test sensors.
- Run Zeek with the lowest rights it needs, and keep the sensor management interface off business networks.
- Watch the Zeek process for unexpected crashes or restarts, which can signal malformed packets reaching the parser.
- Apply CISA's guidance on control system network exposure.
Why it matters
An out-of-bounds read does not write memory, but it can still hurt. Reading past a buffer can crash the process, which is the availability impact here, and can expose adjacent memory, which is the confidentiality impact.
For a monitoring sensor, a crash is a visibility problem. If an attacker can knock the sensor offline with one packet, they can choose when you are blind. Treat availability of detection tooling as a security property, and alert on sensor restarts.
Quick check
Can this bug run code?
The advisory says this one can crash the process and leak some memory. The code execution risk belongs to CVE-2023-7243 and CVE-2023-7244.
What fixes it?
Commit 3bca34c or later of the plugin, per CISA.
Sources
Last reviewed: 19 October 2026.
