Intrusion PreventionICCP.Invalid.OSI.PSEL.Abort.PDU
Description
The OSI Connection Oriented Transport Protocol (COTP) is used by ICCP to establish sessions and exchange connection parameters. An ICCP Server has sent a ACSE Abort Message message in response to an invalid Presentation Layer Selector (PSEL) received from the client. An attacker might be trying to brute force the PSEL in order to send valid MMS/ICCP messages.
Affected Products
ICCP servers and MMS-based applications.
Impact
System compromise.
Recommended Actions
Investigate the source of the traffic to prevent further attacks.
Telemetry
Coverage
| IPS (Regular DB) | |
| IPS (Extended DB) |
| ID | 11519 |
| Created | Dec 20, 2005 |
| Updated | Feb 24, 2022 |
| Risk |
|
| Default Action | pass |
| Active | |
| Affected OS | Other |
| Affected App | SCADA |