Before networking a FANUC CNC: checking security advisories and restricting external access
Network connectivity and suitability for direct external access require separate checks. Using FANUC’s published embedded-Ethernet advisory, this article explains product-scope checks, version records and access restrictions coordinated with network administrators.
Contents
Workshops may gradually connect CNCs to networks for program transfer or remote maintenance. Before adding a connection, confirm both its production purpose and access boundary. Obtaining an IP address and transferring files do not mean arbitrary external access should be allowed. Machine maintenance personnel and enterprise network administrators must jointly confirm the network plan.
Read the affected products and publication date first
On November 26, 2020, FANUC published an embedded Ethernet TCP/IP denial-of-service advisory, CVE-2020-12739. It states that exploitation may stop network functions and lists several affected CNC series. The advisory recommends identifying unauthorized communication devices and restricting unauthorized external access using measures such as firewalls. It does not provide one “safe software edition” that applies to every model.
Do not decide solely from the FANUC name
First record the machine asset number, complete CNC model, network interface actually used, and software series and edition, then compare them with the advisory’s specific scope. Check embedded Ethernet separately from other options. If uncertain, submit these details to the equipment supplier or manufacturer support for confirmation. Record the check date and response, and reassess after board replacement or upgrades.
Make a simple inventory of network access
- List which computers or systems need to connect to the machine, identifying whether each connection serves program transfer, data collection or maintenance.
- State who approves new access, who manages accounts, and how permissions are withdrawn when personnel or suppliers change.
- Have network administrators verify boundary rules, retaining only confirmed communications needed for business. Remote maintenance should have a defined time window and responsible person.
- Record test results and the rollback method in the change log, confirming that access restrictions have not interrupted essential production communications.
Preserve evidence when network functions stop
A network malfunction does not automatically mean an attack. Assess it alongside equipment alarms, connection status and network records. The advisory says power cycling can recover the described condition, but restored communication does not remove the exposure. Restarting must follow machine shutdown and maintenance procedures; frequent restarts are not a lasting solution. Also record the time, affected scope and recent network changes.
This is a method for reading advisories and checking site conditions, not a security assessment of a specific machine. Continue checking the official FANUC vulnerability-advisory directory; an old advisory is not a complete description of the current situation. For version records, see recording 0i-F system identity. Other maintenance material is in the FANUC section.
References and applicability
- FANUC: Embedded Ethernet TCP/IP denial-of-service advisory (2020-11-26): page 1, impact, affected products and mitigations.
- Official FANUC product vulnerability-advisory directory: consult subsequent advisories for the applicable product.