CVE-2020-35685 - An issue was discovered in HCC Nichestack 3.0

Back Back to CVE browser

CRITICAL

An issue was discovered in HCC Nichestack 3.0

Published Aug 19, 2021

9.1

CRITICAL

CVSS 3.1

EPSS 2.05%

Description

An issue was discovered in HCC Nichestack 3.0. The code that generates Initial Sequence Numbers (ISNs) for TCP connections derives the ISN from an insufficiently random source. As a result, an attacker may be able to determine the ISN of current and future TCP connections and either hijack existing ones or spoof future ones. (Proper ISN generation should aim to follow at least the specifications outlined in RFC 6528.)

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-330

Insufficient Randomness

References (5)

https://cert-portal.siemens.com/productcert/pdf/ssa-789208.pdf
x_refsource_CONFIRMMitigationThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-23344
Advisory
https://www.forescout.com/blog/new-critical-operational-technology-vulnerabilities-found-on-nichestack/
x_refsource_MISCMitigationThird Party Advisory
https://www.hcc-embedded.com
x_refsource_MISCProduct
https://www.kb.cert.org/vuls/id/608209
third-party-advisoryx_refsource_CERT-VNThird Party AdvisoryUS Government Resource

Link	Providers	Tags
https://cert-portal.siemens.com/productcert/pdf/ssa-789208.pdf		x_refsource_CONFIRMMitigationThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-23344		Advisory
https://www.forescout.com/blog/new-critical-operational-technology-vulnerabilities-found-on-nichestack/		x_refsource_MISCMitigationThird Party Advisory
https://www.hcc-embedded.com		x_refsource_MISCProduct
https://www.kb.cert.org/vuls/id/608209		third-party-advisoryx_refsource_CERT-VNThird Party AdvisoryUS Government Resource