CVE-2023-7244 is an out-of-bounds write in the primary analysis function of the ICSNPP Ethercat plugin for Zeek. It scores 9.8 (Critical) and could allow arbitrary code execution. Plugin commits d78dda6 and earlier are affected. CISA advises updating to commit 3bca34c or later.
What's affected
Affected: the Industrial Control Systems Network Protocol Parsers (ICSNPP) Ethercat plugin for Zeek, at commit d78dda6 and prior. Fixed: update to commit 3bca34c or later, per CISA advisory ICSA-24-051-02. The plugin is published as GitHub commits, not numbered releases, so versions are commit hashes.
The advisory covers three CVEs in the same plugin: CVE-2023-7243 and CVE-2023-7244 (out-of-bounds writes, each 9.8) and CVE-2023-7242 (out-of-bounds read, 8.2). One update fixes all three. KEV is false for each, and the advisory does not describe exploitation in the wild. CISA credits the report to a researcher at HACK@UCF.
This entry covers the primary analysis function for EtherCAT communication packets. Its sibling CVE-2023-7243 covers the handling of specific datagrams. The weakness for both is CWE-787. The vector is network reachable with no privileges and no user interaction.
How to check if you're exposed
If you installed the plugin from source or through the Zeek package manager, find the cloned directory and check the commit.
cd /path/to/icsnpp-ethercat
git log --oneline -1
git merge-base --is-ancestor 3bca34c HEAD && echo has-fix || echo missing-fix
If it prints missing-fix, you are on a vulnerable commit. If you manage Zeek sensors in bulk, add this check to your sensor configuration review.
What to do now
- Update the ICSNPP Ethercat plugin to commit 3bca34c or later and restart Zeek.
- Inventory every Zeek sensor that loads the plugin, including lab and test sensors.
- Run Zeek with the lowest rights it needs, and keep the sensor management interface off business networks.
- Watch the Zeek process for unexpected crashes or restarts, which can signal malformed packets reaching the parser.
- Apply CISA's guidance on control system network exposure.
Why it matters
Two separate out-of-bounds writes in one plugin suggest the parsing code lacks consistent length checks. The usual remedy is bounds checking at each read and write in the parser, and fuzz testing against protocol edge cases.
For operators, the point is that protocol parsers for industrial traffic are lightly reviewed compared with parsers for common internet protocols. If you have added community plugins to a sensor, treat them as software that needs patching, not as configuration.
Quick check
How does this differ from CVE-2023-7243?
Both are out-of-bounds writes in the same plugin, in different code paths. This one is in the primary analysis function.
Is the plugin on a release schedule?
The advisory refers to commits, not releases. Track the repository for updates.
Sources
Last reviewed: 19 October 2026.
