Intrusion PreventionICCP.Invalid.OSI.SSEL.Refuse.PDU
Description
The OSI Connection Oriented Transport Protocol (COTP) is used by ICCP to establish sessions and exchange connection parameters. An ICCP Server has sent a Session Refuse PDU message in response to an invalid OSI Session Layer Selector value received from the client. An attacker might be trying to brute force the SSEL. The correct SSEL is required in order to send valid MMS/ICCP messages.
Affected Products
ICCP servers and MMS-based applications.
Impact
Information Leakage, Denial of Service.
Recommended Actions
Investigate the source of the traffic to prevent further attacks.
Telemetry
Coverage
| IPS (Regular DB) | |
| IPS (Extended DB) |
| ID | 11518 |
| Created | Dec 20, 2005 |
| Updated | Feb 24, 2022 |
| Risk |
|
| Default Action | drop |
| Active | |
| Affected OS | Other |
| Affected App | SCADA |