CVE-2020-27213

highpriority · track · 30OT risk · elevatedstack campaign · NUMBER:JACKEPSS 0.010 · 62 %ileDEEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.97% (62nd) EPSS

CVSS 7.5 · high

Is it mine?

35 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-27

An issue was discovered in Ethernut Nut/OS 5.1. The code that generates Initial Sequence Numbers (ISNs) for TCP connections derives the ISN from an insufficiently random source. As a result, an attacker may be able to determine the ISN of current and future TCP connections and either hijack existing ones or spoof future ones. While the ISN generator seems to adhere to RFC 793 (where a global 32-bit counter is incremented roughly every 4 microseconds), proper ISN generation should aim to follow at least the specifications outlined in RFC 6528.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedCapital VSTARcisa_csaf_ot
uIP-Contiki-NG has a patch in progress. See general recommendations below until a patch is made available.
FixedCycloneTCPcisa_csaf_ot
uIP-Contiki-NG has a patch in progress. See general recommendations below until a patch is made available.
FixedFNETcisa_csaf_ot
uIP-Contiki-NG has a patch in progress. See general recommendations below until a patch is made available.
FixedMPLAB Netcisa_csaf_ot
uIP-Contiki-NG has a patch in progress. See general recommendations below until a patch is made available.
FixedNDKTCPIPcisa_csaf_ot
uIP-Contiki-NG has a patch in progress. See general recommendations below until a patch is made available.
FixedNucleus NET Allcisa_csaf_ot
uIP-Contiki-NG has a patch in progress. See general recommendations below until a patch is made available.
FixedNucleus ReadyStart for ARM MIPS and PPCcisa_csaf_ot
uIP-Contiki-NG has a patch in progress. See general recommendations below until a patch is made available.
FixedNucleus Source Codecisa_csaf_ot
uIP-Contiki-NG has a patch in progress. See general recommendations below until a patch is made available.
FixedNut/Netcisa_csaf_ot
uIP-Contiki-NG has a patch in progress. See general recommendations below until a patch is made available.
FixedpicoTCP (EOL)cisa_csaf_ot
uIP-Contiki-NG has a patch in progress. See general recommendations below until a patch is made available.
FixedpicoTCP-NGcisa_csaf_ot
uIP-Contiki-NG has a patch in progress. See general recommendations below until a patch is made available.
FixeduC/TCP-IP (EOL)cisa_csaf_ot
uIP-Contiki-NG has a patch in progress. See general recommendations below until a patch is made available.
FixeduIP (EOL)cisa_csaf_ot
uIP-Contiki-NG has a patch in progress. See general recommendations below until a patch is made available.
FixeduIP-Contiki-NGcisa_csaf_ot
uIP-Contiki-NG has a patch in progress. See general recommendations below until a patch is made available.
FixeduIP-Contiki-OS (end-of-life [EOL])cisa_csaf_ot
uIP-Contiki-NG has a patch in progress. See general recommendations below until a patch is made available.
MitigationCapital VSTARcisa_csaf_ot
Nut/Net has a patch in progress. See general recommendations below until a patch is made available.
MitigationCycloneTCPcisa_csaf_ot
Nut/Net has a patch in progress. See general recommendations below until a patch is made available.
MitigationFNETcisa_csaf_ot
Nut/Net has a patch in progress. See general recommendations below until a patch is made available.
MitigationMPLAB Netcisa_csaf_ot
Nut/Net has a patch in progress. See general recommendations below until a patch is made available.
MitigationNDKTCPIPcisa_csaf_ot
Nut/Net has a patch in progress. See general recommendations below until a patch is made available.
MitigationNucleus NET Allcisa_csaf_ot
Nut/Net has a patch in progress. See general recommendations below until a patch is made available.
MitigationNucleus ReadyStart for ARM MIPS and PPCcisa_csaf_ot
Nut/Net has a patch in progress. See general recommendations below until a patch is made available.
MitigationNucleus Source Codecisa_csaf_ot
Nut/Net has a patch in progress. See general recommendations below until a patch is made available.
MitigationNut/Netcisa_csaf_ot
Nut/Net has a patch in progress. See general recommendations below until a patch is made available.
MitigationpicoTCP (EOL)cisa_csaf_ot
Nut/Net has a patch in progress. See general recommendations below until a patch is made available.
MitigationpicoTCP-NGcisa_csaf_ot
Nut/Net has a patch in progress. See general recommendations below until a patch is made available.
MitigationuC/TCP-IP (EOL)cisa_csaf_ot
Nut/Net has a patch in progress. See general recommendations below until a patch is made available.
MitigationuIP (EOL)cisa_csaf_ot
Nut/Net has a patch in progress. See general recommendations below until a patch is made available.
MitigationuIP-Contiki-NGcisa_csaf_ot
Nut/Net has a patch in progress. See general recommendations below until a patch is made available.
MitigationuIP-Contiki-OS (end-of-life [EOL])cisa_csaf_ot
Nut/Net has a patch in progress. See general recommendations below until a patch is made available.

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.5–7.5

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Nprimary · NVD / NIST USexploitability 3.9 · impact 3.6

v3.07.5highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Nsecondary · CISA US

v3.16.5mediumAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Nsecondary · FSTEC (BDU) RU

v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-330USprimaryCWE-330USCWE-330US

affected products (35)

Products and version ranges known to be affected.

Open Source TCP/IP Stackall versionscert_bundDEcpe:/a:open_source:tcpip_stack:-
Siemens Nucleus RTOSall versionscert_bundDEcpe:/o:siemens:nucleus_rtos:-
Capital VSTAR: All Versionsall versionscisa_csaf_otUS
CycloneTCP: Version 1.9.6 and priorall versionscisa_csaf_otUS
FNET: Version 4.6.3all versionscisa_csaf_otUS
MPLAB Net: Version 3.6.1 and priorall versionscisa_csaf_otUS
NDKTCPIP: Version 2.25 and priorall versionscisa_csaf_otUS
Nucleus NET All: versions prior to Version 5.2all versionscisa_csaf_otUS
Nucleus ReadyStart for ARM MIPS and PPC: All versions prior to Version 2012.12all versionscisa_csaf_otUS
Nucleus Source Code: All Versionsall versionscisa_csaf_otUS
Nut/Net: Version 5.1 and priorall versionscisa_csaf_otUS
picoTCP (EOL): Version 1.7.0 and priorall versionscisa_csaf_otUS
picoTCP-NG: Version 1.7.0 and priorall versionscisa_csaf_otUS
uC/TCP-IP (EOL): Version 3.6.0 and priorall versionscisa_csaf_otUS
uIP (EOL): Version 1.0 and priorall versionscisa_csaf_otUS
uIP-Contiki-NG: Version 4.5 and priorall versionscisa_csaf_otUS
uIP-Contiki-OS (end-of-life [EOL]): Version 3.0 and priorall versionscisa_csaf_otUS
multiple Capital VSTARall versionscisa_csaf_otUS
multiple CycloneTCP≤ 1.9.6cisa_csaf_otUS
multiple FNETall versionscisa_csaf_otUS

showing 20 of 35

advisories (2)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2023-1987TCP/IP Stack: Mehrere SchwachstellenDeutsch2021-02-11csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in TCP/IP Stack ausnutzen, um beliebigen Programmcode auszuführen, einen Denial-of-Service-Zustand herbeiführen oder Sicherheitsvorkehrungen umgehen.
ICSA-21-042-01Multiple Embedded TCP/IP Stacks (Update B)2021-02-11icsa · cisa_csaf_otUS
Successful exploitation of weak initial sequence numbers (ISN) can be used to hijack or spoof TCP connections, cause denial-of-service conditions, inject malicious data, or bypass authentication.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund cisa_csaf_ot NVD CVE.org MITRE

published 2023-10-10modified 2026-06-17

related (573)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2019-5420US	critical9.8OT critical	89.3% (100th)	Exploit	2019-03-27
A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically generated development mode secret token. Thi…
CVE-2021-34646US	critical9.8OT high	50.9% (99th)	Exploit	2021-08-30
Versions up to, and including, 5.4.3, of the Booster for WooCommerce WordPress plugin are vulnerable to authentication bypass via the process_email_verification function due to a r…
CVE-2018-17888US	critical9.8OT high	29.6% (98th)	Exploit	2018-10-12
NUUO CMS all versions 3.1 and prior, The application uses a session identification mechanism that could allow attackers to obtain the active session ID, which could allow arbitrary…
CVE-2017-6026US	critical9.1OT high	31.8% (98th)	Exploit	2017-06-30
A Use of Insufficiently Random Values issue was discovered in Schneider Electric Modicon PLCs Modicon M241, firmware versions prior to Version 4.0.5.11, and Modicon M251, firmware…
CVE-2022-36536US	critical9.8OT high	4.85% (92nd)	Exploit	2022-09-16
An issue in the component post_applogin.php of Super Flexible Software GmbH & Co. KG Syncovery 9 for Linux v9.47x and below allows attackers to escalate privileges via creating cra…

+568 more

references (15)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan