SSA-434032: Input Validation Vulnerability in the DHCP Client of Nucleus RTOS
The DHCP implementation of the networking component (Nucleus NET) in Nucleus Real-Time Operating System (RTOS) contains a vulnerability that could allow an attacker to change the IP address of an affected device to an invalid value. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2019-13939US | medium4.8 | — | ||
A vulnerability has been identified in APOGEE MEC/MBC/PXC (P2) (All versions < V2.8.2), APOGEE PXC Compact (BACnet) (All versions < V3.5.3), APOGEE PXC Compact (P2 Ethernet) (All v… | ||||
references
External citations — patches, advisories, analysis.
remediations (10)
- MitigationCapital Embedded AR Classic 431-422
Avoid using DHCP Client of Nucleus NET
- MitigationCapital Embedded AR Classic R20-11
Avoid using DHCP Client of Nucleus NET
- MitigationNucleus NET
Avoid using DHCP Client of Nucleus NET
- MitigationNucleus ReadyStart V3
Avoid using DHCP Client of Nucleus NET
- MitigationNucleus Source Code
Avoid using DHCP Client of Nucleus NET
- No fix plannedCapital Embedded AR Classic 431-422
Currently no fix is planned
- No fix plannedNucleus NET
Currently no fix is planned
- FixedCapital Embedded AR Classic R20-11
Update to V2303 or later version
- FixedNucleus ReadyStart V3
Update to V2017.02.3 or later version
- FixedNucleus Source Code
Contact customer support to receive patch and update information
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan