CVE-2020-27009

mediumpriority · track · 35stack campaign · NAME:WRECKEPSS 0.072 · 94 %ileDEEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

7.19% (94th) EPSS

CVSS 6.8 · medium

Is it mine?

36 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-26

A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (All versions < V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.20), Nucleus NET (All versions < V5.2), Nucleus Source Code (Versions including affected DNS modules), TALON TC Compact (BACnet) (All versions < V3.5.5), TALON TC Modular (BACnet) (All versions < V3.5.5). The DNS domain name record decompression functionality does not properly validate the pointer offset values. The parsing of malformed responses could result in a write past the end of an allocated structure. An attacker with a privileged position in the network could leverage this vulnerability to execute code in the context of the current process or cause a denial-of-service condition.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedAPOGEE PXC Compact (BACnet)siemens_psirt
Update to V3.5.5 or later version
https://partnerportal.extranet.dc.siemens.com/
FixedAPOGEE PXC Compact (P2 Ethernet)siemens_psirt
Update to V2.8.20 or later version
https://partnerportal.extranet.dc.siemens.com/
FixedAPOGEE PXC Modular (BACnet)siemens_psirt
Update to V3.5.5 or later version
https://partnerportal.extranet.dc.siemens.com/
FixedAPOGEE PXC Modular (P2 Ethernet)siemens_psirt
Update to V2.8.20 or later version
https://partnerportal.extranet.dc.siemens.com/
FixedTALON TC Compact (BACnet)siemens_psirt
Update to V3.5.5 or later version
https://partnerportal.extranet.dc.siemens.com/
FixedTALON TC Modular (BACnet)siemens_psirt
Update to V3.5.5 or later version
https://partnerportal.extranet.dc.siemens.com/
FixedNucleus Source Codesiemens_psirt
Contact customer support to receive patch and update information
FixedNucleus Source Codecisa_csaf_ot
Contact customer support to receive patch and update information
FixedAPOGEE PXC Compact (BACnet)cisa_csaf_ot
Update to V3.5.5 or later version
https://partnerportal.extranet.dc.siemens.com/
FixedAPOGEE PXC Compact (P2 Ethernet)cisa_csaf_ot
Update to V2.8.20 or later version
https://partnerportal.extranet.dc.siemens.com/
FixedAPOGEE PXC Modular (BACnet)cisa_csaf_ot
Update to V3.5.5 or later version
https://partnerportal.extranet.dc.siemens.com/
FixedAPOGEE PXC Modular (P2 Ethernet)cisa_csaf_ot
Update to V2.8.20 or later version
https://partnerportal.extranet.dc.siemens.com/
FixedTALON TC Compact (BACnet)cisa_csaf_ot
Update to V3.5.5 or later version
https://partnerportal.extranet.dc.siemens.com/
FixedTALON TC Modular (BACnet)cisa_csaf_ot
Update to V3.5.5 or later version
https://partnerportal.extranet.dc.siemens.com/
MitigationNucleus NETsiemens_psirt
Contact customer support or your local Nucleus Sales team for mitigation advice
MitigationNucleus NETcisa_csaf_ot
Contact customer support or your local Nucleus Sales team for mitigation advice
WorkaroundNucleus NETsiemens_psirt
Avoid using DNS client of affected versions
WorkaroundNucleus Source Codesiemens_psirt
Avoid using DNS client of affected versions
WorkaroundNucleus NETcisa_csaf_ot
Avoid using DNS client of affected versions
WorkaroundNucleus Source Codecisa_csaf_ot
Avoid using DNS client of affected versions
No fix plannedNucleus NETsiemens_psirt
Currently no remediation is planned
No fix plannedNucleus NETcisa_csaf_ot
Currently no remediation is planned

cvss

Technical severity, 0–10. One row per scoring source.

8.1

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.8–8.1

v2.06.8mediumAV:N/AC:M/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 8.6 · impact 6.4

v3.18.1highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 2.2 · impact 5.9

v3.18.1highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:Csecondary · CISA US

v3.18.1highAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.18.1highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:Csecondary · ENISA EU

v3.18.1highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · productcert@siemens.com DEexploitability 2.2 · impact 5.9

v3.18.1highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:Csecondary · Siemens ProductCERT DE

v3.17.4highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-787USprimaryCWE-823USCWE-823USCWE-823USCWE-823US

affected products (36)

Products and version ranges known to be affected.

Microsoft Azure RTOS NetXall versionscert_bundDEcpe:/o:microsoft:azure_rtos_netx:-
Siemens Nucleus Netall versionscert_bundDEcpe:/a:siemens:nucleus_net:-
Siemens Nucleus RTOSall versionscert_bundDEcpe:/o:siemens:nucleus_rtos:-
Wind River VxWorksall versionscert_bundDEcpe:/o:windriver:vxworks:-
Nucleus NETall versionscisa_csaf_otUS
Nucleus Source Codeall versionscisa_csaf_otUS
Siemens APOGEE PXC Compact (BACnet)< V3.5.5cisa_csaf_otUS
Siemens APOGEE PXC Compact (P2 Ethernet)< V2.8.20cisa_csaf_otUS
Siemens APOGEE PXC Modular (BACnet)< V3.5.5cisa_csaf_otUS
Siemens APOGEE PXC Modular (P2 Ethernet)< V2.8.20cisa_csaf_otUS
Siemens Nucleus NET< V5.2cisa_csaf_otUS
Siemens Nucleus Source Code≤ including_affected_DNS_modulescisa_csaf_otUS
Siemens TALON TC Compact (BACnet)< V3.5.5cisa_csaf_otUS
Siemens TALON TC Modular (BACnet)< V3.5.5cisa_csaf_otUS
Siemens APOGEE PXC Compact (BACnet)All versions → V3.5.5enisa_euvdEU
Siemens APOGEE PXC Compact (P2 Ethernet)All versions → V2.8.20enisa_euvdEU
Siemens APOGEE PXC Modular (BACnet)All versions → V3.5.5enisa_euvdEU
Siemens APOGEE PXC Modular (P2 Ethernet)All versions → V2.8.20enisa_euvdEU
Siemens Nucleus NETAll versions → V5.2enisa_euvdEU
Siemens Nucleus Source Code≤ Versions including affected DNS modulesenisa_euvdEU

showing 20 of 36

advisories (5)

Vendor and ecosystem advisories describing this.

SSA-180579SSA-180579: Privilege Management Vulnerability and Multiple Nucleus RTOS Vulnerabilities in APOGEE/TALON Field Panels before V3.5.5/V2.8.202022-12-13csaf · siemens_psirtDE
APOGEE PXC / TALON TC field panels (BACnet before V3.5.5 and P2 Ethernet before V2.8.20) contain multiple vulnerabilities: - CVE-2022-45937: A privilege management vulnerability that could allow low privilege authenticated attackers to gain high privilege access. - CVE-2020-28388: Predictable Initial Sequence Numbers in the TCP/IP Stack of Nucleus RTOS (real-time operating system) used by the affected products. - Several vulnerabilities in the DNS (domain name service) implementation of Nucleus RTOS. Siemens has released updates for the affected products and recommends to update to the latest versions.
SSA-185699SSA-185699: Out of Bounds Write Vulnerabilities (NAME:WRECK) in the DNS Module of Nucleus RTOS2021-04-13csaf · siemens_psirtDE
Security researchers discovered and disclosed 9 vulnerabilities in several DNS implementations, also known as “NAME:WRECK” vulnerabilities. The vulnerabilities described in this advisory are from this set. The DNS client of the networking component (Nucleus NET) in Nucleus Real-Time Operating System (RTOS) contains two out of bounds write vulnerabilities in the handling of DNS responses that could allow an attacker to cause a denial-of-service condition or to remotely execute code. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not available.
WID-SEC-W-2023-1986NAME:WRECK: Mehrere Schwachstellen in TCP/IP StacksDeutsch2021-04-15csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Siemens Nucleus Net, Siemens Nucleus RTOS, Microsoft Azure RTOS NetX und Wind River VxWorks ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen oder einen Denial of Service zu verursachen.
ICSA-21-103-04Siemens Nucleus Products DNS Module (Update A)2021-04-13icsa · cisa_csaf_otUS
Security researchers discovered and disclosed 9 vulnerabilities in several DNS implementations, also known as “NAME:WRECK” vulnerabilities. The vulnerabilities described in this advisory are from this set. The DNS client of the networking component (Nucleus NET) in Nucleus Real-Time Operating System (RTOS) contains two out of bounds write vulnerabilities in the handling of DNS responses that could allow an attacker to cause a denial-of-service condition or to remotely execute code. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not available.
ICSA-22-349-16Siemens APOGEE and TALON2022-12-13icsa · cisa_csaf_otUS
APOGEE PXC / TALON TC field panels (BACnet before V3.5.5 and P2 Ethernet before V2.8.20) contain multiple vulnerabilities: - CVE-2022-45937: A privilege management vulnerability that could allow low privilege authenticated attackers to gain high privilege access. - CVE-2020-28388: Predictable Initial Sequence Numbers in the TCP/IP Stack of Nucleus RTOS (real-time operating system) used by the affected products. - Several vulnerabilities in the DNS (domain name service) implementation of Nucleus RTOS. Siemens has released updates for the affected products and recommends to update to the latest versions.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund cisa_csaf_ot siemens_psirt NVD CVE.org MITRE

published 2021-04-22modified 2026-06-17

related (16,096)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-86950US	—OT critical	26.2% (98th)	KEV	2026-09-28
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1,…
CVE-2026-87491US	—OT critical	3.51% (89th)	KEV	2026-09-09
Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security…
CVE-2026-53362US	—OT critical	0.71% (53rd)	KEV	2026-07-04
In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branc…
CVE-2026-53266US	—OT critical	0.93% (61st)	KEV	2026-06-25
In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite writable The ebtables SNAT target keeps the Ethernet source addre…
CVE-2026-11645US	—OT critical	2.44% (84th)	KEV	2026-06-09
Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium…

+16091 more

references (10)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan