CVE-2020-35685

mediumPriorität · verfolgen · 37OT-Risiko · erhöhtStack-Kampagne · INFRA:HALTEPSS 0.021 · 81. PerzentilDEEURUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
2.05% (81st) EPSS
CVSS 6.4 · medium
Is it mine?
29 products
Prüfe deine Angriffsfläche
Who says so?
8 sources
cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · bewertet 2026-10-27

An issue was discovered in HCC Nichestack 3.0. The code that generates Initial Sequence Numbers (ISNs) for TCP connections derives the ISN from an insufficiently random source. As a result, an attacker may be able to determine the ISN of current and future TCP connections and either hijack existing ones or spoof future ones. (Proper ISN generation should aim to follow at least the specifications outlined in RFC 6528.)

01

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

  • BehobenSENTRON 3WA COM190siemens_psirt

    Update to V2.0.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109782123/
  • BehobenSENTRON 3WL COM35siemens_psirt

    Update to V1.2.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109766651/
  • BehobenSENTRON 7KM PAC Switched Ethernet PROFINET Expansion Modulesiemens_psirt

    Update to V2.1.6 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109749555/
  • Behobenpilz_psirt

    | Produkt | Maßnahme | |----------------------------------------------|------------------------------------------------------| | PSSu-Module für dezentrales E/A-System | siehe Mitigation | | PSSu-Module für PSS 4000 | Firmware auf 1.22.2 aktualisieren * | | PNOZ m B1 | siehe Mitigation ** | | PNOZ m ES ETH | siehe Mitigation ** | | PNOZ mmc1p ETH | siehe Mitigation | | Base-Device PNOZ mxp ETH (PNOZmulti Classic) | siehe Mitigation | \* CVE-2020-35685 wird in diesem Update nicht behoben, da es keine Auswirkungen auf die Sicherheit der verwendeten Dienste und Protokolle (MODBUS/TCP und RAW-TCP) hat. \** Diese Produkte sind im Feld nicht updatefähig. Sie verwenden eine vom Hersteller vorinstallierte, feste Firmware.

  • Behobenphoenix_contact_psirt

    Phoenix Contact Classic Line Controllers are designed and developed for the use in closed industrial networks. The control and configuration protocols do not feature authentication mechanisms by design. Phoenix Contact therefore strongly recommends using the devices exclusively in closed networks and protected by a suitable firewall. Phoenix Contact is offering the mGuard product family for network segmentation and protection.

  • BehobenInterNiche stackcisa_csaf_ot

    Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:

    https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-022_en.pdf
  • BehobenNicheLitecisa_csaf_ot

    Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:

    https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-022_en.pdf
  • Mitigationpilz_psirt

    It is adviced to use firewalls or similar network security devices to prevent unauthorized network communication to the products affected.

  • Mitigationphoenix_contact_psirt

    Customers using Phoenix Contact Classic Line Controllers are strongly recommended to operate the devices in closed networks or protected with a suitable firewall as intended. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our application note: Measures to protect network-capable devices with Ethernet connection

  • Kein Fix geplantSENTRON 7KM PAC Switched Ethernet PROFINET Expansion Modulesiemens_psirt

    Currently no remediation is planned

02

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

9.1
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–critical · 6.4–9.1

v2.06.4mediumAV:N/AC:L/Au:N/C:P/I:P/A:Nprimary · NVD / NIST USAusnutzbarkeit 10 · Auswirkung 4.9
v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 5.2
v3.07.5highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Nsecondary · CISA US
v3.17.5highAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Nsecondary · FSTEC (BDU) RU
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:Csecondary · Siemens ProductCERT DE
v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · Phoenix Contact PSIRT DE
v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · Pilz PSIRT DE
v3.18.3highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)
03

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-330USprimärCWE-330USCWE-330USCWE-330USCWE-330USCWE-330USCWE-451US
04

betroffene Produkte (29)

Betroffene Produkte und Versionsbereiche.

20 von 29 angezeigt
05

Advisories (4)

Hersteller- und Ökosystem-Meldungen dazu.

  • SSA-789208SSA-789208: Multiple Vulnerabilities (INFRA:HALT) in Interniche IP-Stack based Low Voltage Devices2021-08-04csaf · siemens_psirtDE

    Security researchers discovered and disclosed 14 vulnerabilities in the Interniche IP stack, also known as "INFRA:HALT" vulnerabilities [0]. This advisory describes the impact to Siemens low voltage products, which are only affected by four out of the 14 vulnerabilities. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available. [0] https://www.forescout.com/blog/new-critical-operational-technology-vulnerabilities-found-on-nichestack/

  • VDE-2021-009Pilz: Multiple products prone to Niche Ethernet Stack vulnerabilities2021-09-20csaf · pilz_psirtDE

    Multiple products of PILZ utilise a third-party TCP/IP implementation - the "Niche Ethernet Stack". This TCP/IP stack contains multiple vulnerabilities which are therefore affecting the products listed above.

  • VDE-2021-032PHOENIX CONTACT: Niche Ethernet Stack for ILC1x0, ILC1x1 and AXC 1050 Industrial controllers and CHARX control DC2021-08-04csaf · phoenix_contact_psirtDE

    Third party Niche Ethernet stack has several vulnerabilities announced by the security researcher's community. Phoenix Contact Classic Line industrial controllers are developed and designed for the use in closed industrial networks. The communication protocols and device access do not feature authentication measures. Remote attackers can use specially crafted IP packets to cause a Denial of Service or a Breach of Integrity of the PLC.

  • ICSA-21-217-01HCC Embedded InterNiche TCP/IP stack, NicheLite (Update B)2021-08-05icsa · cisa_csaf_otUS

    Successful exploitation of these vulnerabilities may result in unauthorized access to arbitrary information, DNS cache poisoning, remote code execution, or a denial-of-service condition.

06

auch bekannt als (4)

Weitere Namen und Kennungen dieser Entität.

07

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvdenisa_euvdfstec_bducisa_csaf_otnvdphoenix_contact_psirtpilz_psirtsiemens_psirtNVDCVE.orgMITRE
veröffentlicht 2021-08-19geändert 2026-06-17
09

Referenzen (16)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan