Siemens Nucleus Products DNS Module (Update A)
Security researchers discovered and disclosed 9 vulnerabilities in several DNS implementations, also known as “NAME:WRECK” vulnerabilities. The vulnerabilities described in this advisory are from this set. The DNS client of the networking component (Nucleus NET) in Nucleus Real-Time Operating System (RTOS) contains two out of bounds write vulnerabilities in the handling of DNS responses that could allow an attacker to cause a denial-of-service condition or to remotely execute code. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not available.
describes (2)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-27009US | high8.1 | — | ||
A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (… | ||||
| CVE-2020-15795US | high8.1 | — | ||
A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (… | ||||
references
External citations — patches, advisories, analysis.
- SSA-185699: Out of Bounds Write Vulnerabilities (NAME:WRECK) in the DNS Module of Nucleus RTOS - CSAF Versionself
- SSA-185699: Out of Bounds Write Vulnerabilities (NAME:WRECK) in the DNS Module of Nucleus RTOS - PDF Versionself
- SSA-185699: Out of Bounds Write Vulnerabilities (NAME:WRECK) in the DNS Module of Nucleus RTOS - TXT Versionself
- ICS Advisory ICSA-21-103-04 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-21-103-04 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (10)
- MitigationNucleus NET
Contact customer support or your local Nucleus Sales team for mitigation advice
- MitigationNucleus NET
Contact customer support or your local Nucleus Sales team for mitigation advice
- No fix plannedNucleus NET
Currently no remediation is planned
- No fix plannedNucleus NET
Currently no remediation is planned
- FixedNucleus Source Code
Contact customer support to receive patch and update information
- FixedNucleus Source Code
Contact customer support to receive patch and update information
- WorkaroundNucleus NET
Avoid using DNS client of affected versions
- WorkaroundNucleus NET
Avoid using DNS client of affected versions
- WorkaroundNucleus Source Code
Avoid using DNS client of affected versions
- WorkaroundNucleus Source Code
Avoid using DNS client of affected versions
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan