SSA-362164: Predictable Initial Sequence Numbers in the TCP/IP Stack of Nucleus RTOS
The networking component (Nucleus NET) in Nucleus Real-Time Operating System (RTOS) use Initial Sequence Numbers for TCP-Sessions that are predictable. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not available.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2020-28388US | medium5.3OT erhöht | — | ||
A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- SSA-362164: Predictable Initial Sequence Numbers in the TCP/IP Stack of Nucleus RTOS - CSAF Versionself
- SSA-362164: Predictable Initial Sequence Numbers in the TCP/IP Stack of Nucleus RTOS - PDF Versionself
- SSA-362164: Predictable Initial Sequence Numbers in the TCP/IP Stack of Nucleus RTOS - TXT Versionself
Behebungen (6)
- MitigationNucleus NET
Contact customer support or your local Nucleus Sales team for mitigation advice
- MitigationNucleus ReadyStart V3
Protect transmitted data with cryptographic protocols such as Transport Layer Security
- MitigationNucleus Source Code
Protect transmitted data with cryptographic protocols such as Transport Layer Security
- Kein Fix geplantNucleus NET
Currently no fix is planned
- BehobenNucleus ReadyStart V3
Update to V2012.12 or later version
https://support.sw.siemens.com/en-US/product/1009925838/ - BehobenNucleus Source Code
Contact customer support to receive patch and update information
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan