# Critical Flaws in Pyramid Solutions' NetStaX EtherNet/IP Stack Expose Industrial Devices to Remote Attack
## The Threat
EtherNet/IP is the backbone of modern industrial automation — it's how Rockwell Allen-Bradley PLCs talk to SCADA systems, how factory floors coordinate assembly, and how critical infrastructure manages physical processes. When vulnerabilities surface in the protocol stacks that implement EtherNet/IP, the blast radius isn't one device. It's every OEM product built on that stack, across every customer who bought it, often without any visibility into what software is running inside.
That's the problem with the Pyramid Solutions NetStaX EtherNet/IP Stack advisory from CISA. NetStaX is a commercial embedded EtherNet/IP implementation marketed to industrial device manufacturers — the kind of component that gets designed into a product once and ships in thousands of units across a decade. Vulnerabilities at this layer can be exploited against devices whose manufacturers may not even realize they're exposed, and whose end-users have no practical way to audit their supply chain.
The flaws identified in NetStaX fall into categories that are disturbingly familiar in ICS security: improper input validation and memory corruption in the protocol parsing layer. An unauthenticated attacker on the same network segment can craft malformed EtherNet/IP packets that trigger stack-based buffer overflows or cause the device to crash outright. In operational technology environments, a crash isn't just an inconvenience — it can halt a production line, disable safety monitoring, or in the worst case, remove automated protections from a physical process.
## Severity and Impact
| CVE | CVSS Score | Vector String | Attack Complexity | Authentication Required | CWE |
|-----|------------|---------------|-------------------|------------------------|-----|
| CVE-2020-25159 | 9.8 (Critical) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | Low | None | CWE-20 (Improper Input Validation) |
The network vector with no authentication requirement is the critical detail here. These aren't vulnerabilities that require an attacker to already have credentials or privileged access. Any host that can reach the EtherNet/IP service — typically TCP/UDP port 44818 — can attempt exploitation. In flat OT networks, that often means any device on the plant floor.
## Affected Products
The NetStaX EtherNet/IP Stack is an OEM component, meaning the direct affected product list understates the real exposure:
Pyramid Solutions — NetStaX EtherNet/IP Stack
Downstream Impact
Organizations should audit their asset inventory for any devices that list Pyramid Solutions as a component vendor in firmware documentation, FCC filings, or product datasheets.
## Mitigations
CISA and Pyramid Solutions recommend the following remediation steps, in order of priority:
Immediate actions:
Network architecture controls:
Detection:
Vendor coordination:
## References
---
## HackWire Analysis
The NetStaX advisory is a textbook illustration of the embedded supply chain problem that ICS security has been warning about for years, and that asset owners still haven't solved.
The issue isn't unique to Pyramid Solutions — it's structural. Industrial device manufacturers buy commercial EtherNet/IP stacks because writing a compliant, interoperable implementation from scratch is expensive and technically demanding. They integrate the SDK, build their product, ship it, and move on. The SDK vendor issues a patch years later. The OEM has to decide whether to cut a new firmware release for a product that may be five years old and out of active development. The end-user, running a water treatment plant or an automotive assembly line, has no idea any of this is happening.
Forescout's Infra:Halt research in 2021 cataloged this dynamic across nine vendors and found that the same vulnerability classes — improper input validation, integer overflows, use-after-free in protocol parsers — recur across every commercial EtherNet/IP implementation they examined. Pyramid Solutions was among those identified. The fact that CISA is issuing advisories on this same product family years later suggests the remediation cycle in OT is still measured in years, not weeks.
For defenders, the practical implication is clear: you cannot assume your EtherNet/IP devices are safe because you haven't seen a vendor notice. You need to know what stacks your devices run, and you need network controls that treat plant-floor EtherNet/IP traffic as potentially hostile by default. The attackers targeting ICS environments — nation-state actors and ransomware groups alike — are absolutely aware of these advisory patterns and move faster than OT patching cycles allow.
The window between advisory and exploit is closing. Assume it's already closed.
— HackWire Editorial
---
## Related Coverage