CVE-2020-25926

mediumpriority · track · 30OT risk · elevatedstack campaign · INFRA:HALTEPSS 0.013 · 69 %ileEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

1.26% (69th) EPSS

CVSS 5 · medium

Is it mine?

8 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · scored 2026-10-27

The DNS client in InterNiche NicheStack TCP/IP 4.0.1 is affected by: Insufficient entropy in the DNS transaction id. The impact is: DNS cache poisoning (remote). The component is: dns_query_type(). The attack vector is: a specific DNS response packet.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedInterNiche stackcisa_csaf_ot
Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-022_en.pdf
FixedNicheLitecisa_csaf_ot
Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-022_en.pdf

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 4–7.5

v2.05mediumAV:N/AC:L/Au:N/C:N/I:P/A:Nprimary · NVD / NIST USexploitability 10 · impact 2.9

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Nprimary · NVD / NIST USexploitability 3.9 · impact 3.6

v3.04mediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:Nsecondary · CISA US

v3.14mediumAV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:Nsecondary · FSTEC (BDU) RU

v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-331USprimaryCWE-20USCWE-330USCWE-330US

affected products (8)

Products and version ranges known to be affected.

InterNiche stack: All versions prior to v4.3all versionscisa_csaf_otUS
NicheLite: All versions prior to v4.3all versionscisa_csaf_otUS
HCC Embedded InterNiche stack< 4.3cisa_csaf_otUS
HCC Embedded NicheLite< 4.3cisa_csaf_otUS
n/a n/a≤ n/aenisa_euvdEU
HCC Embedded InterNiche≤ 4.3fstec_bduRU
HCC Embedded NicheLite≤ 4.3fstec_bduRU
hcc-embedded nichestack tcp/ip= 4.0.1nvdUScpe:2.3:a:hcc-embedded:nichestack_tcp\/ip:*:*:*:*:*:*:*:*

advisories (1)

Vendor and ecosystem advisories describing this.

ICSA-21-217-01HCC Embedded InterNiche TCP/IP stack, NicheLite (Update B)2021-08-05icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities may result in unauthorized access to arbitrary information, DNS cache poisoning, remote code execution, or a denial-of-service condition.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cisa_csaf_ot nvd NVD CVE.org MITRE

published 2021-08-18modified 2026-06-17

related (185)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2008-1447US	medium6.8	95.2% (100th)	Exploit	2008-07-08
The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2) Microsoft DNS in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2; an…
CVE-2018-18326US	high7.5	54.3% (99th)	Exploit	2019-07-03
DNN (aka DotNetNuke) 9.2 through 9.2.2 incorrectly converts encryption key source values, resulting in lower than expected entropy. NOTE: this issue exists because of an incomplete…
CVE-2004-0230US	medium5.0	80.3% (100th)	Exploit	2004-08-18
TCP, when using a large Window Size, makes it easier for remote attackers to guess sequence numbers and cause a denial of service (connection loss) to persistent TCP connections by…
CVE-2018-15812US	high7.5	47.2% (99th)	Exploit	2019-07-03
DNN (aka DotNetNuke) 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than expected entropy.
CVE-2000-0384US	high10.0OT high	5.89% (93rd)	Exploit	2000-05-08
NetStructure 7110 and 7180 have undocumented accounts (servnow, root, and wizard) whose passwords are easily guessable from the NetStructure's MAC address, which could allow remote…

+180 more

references (10)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan