CVE-2023-7243 is an out-of-bounds write in the ICSNPP Ethercat plugin for Zeek, triggered while analyzing specific EtherCAT datagrams. It scores 9.8 (Critical) and could allow arbitrary code execution. Plugin commits d78dda6 and older are affected. CISA advises updating to commit 3bca34c or later.
What's affected
Affected: the Industrial Control Systems Network Protocol Parsers (ICSNPP) Ethercat plugin for Zeek, at commit d78dda6 and prior. Fixed: update to commit 3bca34c or later, per CISA advisory ICSA-24-051-02. The plugin is published as GitHub commits, not numbered releases, so versions are commit hashes.
The advisory covers three CVEs in the same plugin: CVE-2023-7243 and CVE-2023-7244 (out-of-bounds writes, each 9.8) and CVE-2023-7242 (out-of-bounds read, 8.2). One update fixes all three. KEV is false for each, and the advisory does not describe exploitation in the wild. CISA credits the report to a researcher at HACK@UCF.
The weakness is CWE-787, out-of-bounds write. The vector is network reachable, no privileges, no user interaction, and high impact. In plain terms, a network sensor that parses traffic can be attacked by the traffic it is meant to watch.
How to check if you're exposed
If you installed the plugin from source or through the Zeek package manager, find the cloned directory and check the commit.
cd /path/to/icsnpp-ethercat
git log --oneline -1
git merge-base --is-ancestor 3bca34c HEAD && echo has-fix || echo missing-fix
If it prints missing-fix, you are on a vulnerable commit. If you manage Zeek sensors in bulk, add this check to your sensor configuration review.
What to do now
- Update the ICSNPP Ethercat plugin to commit 3bca34c or later and restart Zeek.
- Inventory every Zeek sensor that loads the plugin, including lab and test sensors.
- Run Zeek with the lowest rights it needs, and keep the sensor management interface off business networks.
- Watch the Zeek process for unexpected crashes or restarts, which can signal malformed packets reaching the parser.
- Apply CISA's guidance on control system network exposure.
Why it matters
A network analyzer is software that reads untrusted data by design. When its parser for a protocol writes past the end of a buffer, a crafted packet can corrupt memory and may allow code execution in the sensor process. CWE-787 is the weakness class.
The risk is bigger than one process. Security sensors often sit at a privileged vantage point and see sensitive traffic. A compromised sensor can blind monitoring or become a foothold. That is why parser bugs in monitoring tools deserve the same urgency as bugs in internet facing services.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does one update fix all three Ethercat CVEs?
Yes. CISA's advisory recommends commit 3bca34c or later for CVE-2023-7242, CVE-2023-7243 and CVE-2023-7244.
How do I know my version?
The plugin uses commit hashes. Run git log in the plugin directory and check whether 3bca34c is an ancestor of your commit.
Sources
Last reviewed: 19 October 2026.
