CVE-2020-27737

mediumpriority · track · 27stack campaign · NAME:WRECKEPSS 0.036 · 89 %ileDEEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

3.57% (89th) EPSS

CVSS 5.8 · medium

Is it mine?

40 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-27

A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (All versions < V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.20), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.3), Nucleus ReadyStart V4 (All versions < V4.1.0), Nucleus Source Code (Versions including affected DNS modules), SIMOTICS CONNECT 400 (All versions < V0.5.0.0), TALON TC Compact (BACnet) (All versions < V3.5.5), TALON TC Modular (BACnet) (All versions < V3.5.5). The DNS response parsing functionality does not properly validate various length and counts of the records. The parsing of malformed responses could result in a read past the end of an allocated structure. An attacker with a privileged position in the network could leverage this vulnerability to cause a denial-of-service condition or leak the memory past the allocated structure.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedAPOGEE PXC Compact (BACnet)siemens_psirt
Update to V3.5.5 or later version
https://partnerportal.extranet.dc.siemens.com/
FixedAPOGEE PXC Compact (P2 Ethernet)siemens_psirt
Update to V2.8.20 or later version
https://partnerportal.extranet.dc.siemens.com/
FixedAPOGEE PXC Modular (BACnet)siemens_psirt
Update to V3.5.5 or later version
https://partnerportal.extranet.dc.siemens.com/
FixedAPOGEE PXC Modular (P2 Ethernet)siemens_psirt
Update to V2.8.20 or later version
https://partnerportal.extranet.dc.siemens.com/
FixedTALON TC Compact (BACnet)siemens_psirt
Update to V3.5.5 or later version
https://partnerportal.extranet.dc.siemens.com/
FixedTALON TC Modular (BACnet)siemens_psirt
Update to V3.5.5 or later version
https://partnerportal.extranet.dc.siemens.com/
FixedSIMOTICS CONNECT 400siemens_psirt
Update to V0.5.0.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109778383/
FixedNucleus ReadyStart V3siemens_psirt
Update to V2017.02.3 or later version
https://support.sw.siemens.com/en-US/product/1009925838/
FixedNucleus ReadyStart V4siemens_psirt
Update to V4.1.0 or later version
https://support.sw.siemens.com/en-US/product/1336134128/
FixedNucleus Source Codesiemens_psirt
Contact customer support to receive patch and update information
FixedSIMOTICS CONNECT 400cisa_csaf_ot
Update to V0.5.0.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109778383/
FixedAPOGEE PXC Compact (BACnet)cisa_csaf_ot
Update to V3.5.5 or later version
https://partnerportal.extranet.dc.siemens.com/
FixedAPOGEE PXC Compact (P2 Ethernet)cisa_csaf_ot
Update to V2.8.20 or later version
https://partnerportal.extranet.dc.siemens.com/
FixedAPOGEE PXC Modular (BACnet)cisa_csaf_ot
Update to V3.5.5 or later version
https://partnerportal.extranet.dc.siemens.com/
FixedAPOGEE PXC Modular (P2 Ethernet)cisa_csaf_ot
Update to V2.8.20 or later version
https://partnerportal.extranet.dc.siemens.com/
FixedTALON TC Compact (BACnet)cisa_csaf_ot
Update to V3.5.5 or later version
https://partnerportal.extranet.dc.siemens.com/
FixedTALON TC Modular (BACnet)cisa_csaf_ot
Update to V3.5.5 or later version
https://partnerportal.extranet.dc.siemens.com/
MitigationNucleus NETsiemens_psirt
Avoid using DNS client of affected versions
MitigationNucleus ReadyStart V3siemens_psirt
Avoid using DNS client of affected versions
MitigationNucleus ReadyStart V4siemens_psirt
Avoid using DNS client of affected versions
MitigationNucleus Source Codesiemens_psirt
Avoid using DNS client of affected versions
No fix plannedNucleus NETsiemens_psirt
Currently no remediation is planned

cvss

Technical severity, 0–10. One row per scoring source.

6.5

010

base score 0–10 · higher = more severe · hover a vector to decode

v2.05.8mediumAV:N/AC:M/Au:N/C:P/I:N/A:Pprimary · NVD / NIST USexploitability 8.6 · impact 4.9

v3.16.5mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:Hprimary · NVD / NIST USexploitability 2.2 · impact 4.2

v3.16.5mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H/E:P/RL:O/RC:Csecondary · CISA US

v3.16.5mediumAV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:Hsecondary · FSTEC (BDU) RU

v3.16.5mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H/E:P/RL:O/RC:Csecondary · ENISA EU

v3.16.5mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:Hsecondary · productcert@siemens.com DEexploitability 2.2 · impact 4.2

v3.16.5mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H/E:P/RL:O/RC:Csecondary · Siemens ProductCERT DE

v3.16mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-125USprimaryCWE-125USCWE-125USCWE-125US

affected products (40)

Products and version ranges known to be affected.

Microsoft Azure RTOS NetXall versionscert_bundDEcpe:/o:microsoft:azure_rtos_netx:-
Siemens Nucleus Netall versionscert_bundDEcpe:/a:siemens:nucleus_net:-
Siemens Nucleus RTOSall versionscert_bundDEcpe:/o:siemens:nucleus_rtos:-
Wind River VxWorksall versionscert_bundDEcpe:/o:windriver:vxworks:-
SIMOTICS CONNECT 400all versionscisa_csaf_otUS
Siemens APOGEE PXC Compact (BACnet)< V3.5.5cisa_csaf_otUS
Siemens APOGEE PXC Compact (P2 Ethernet)< V2.8.20cisa_csaf_otUS
Siemens APOGEE PXC Modular (BACnet)< V3.5.5cisa_csaf_otUS
Siemens APOGEE PXC Modular (P2 Ethernet)< V2.8.20cisa_csaf_otUS
Siemens SIMOTICS CONNECT 400< V0.5.0.0cisa_csaf_otUS
Siemens TALON TC Compact (BACnet)< V3.5.5cisa_csaf_otUS
Siemens TALON TC Modular (BACnet)< V3.5.5cisa_csaf_otUS
Siemens APOGEE PXC Compact (BACnet)All versions → V3.5.5enisa_euvdEU
Siemens APOGEE PXC Compact (P2 Ethernet)All versions → V2.8.20enisa_euvdEU
Siemens APOGEE PXC Modular (BACnet)All versions → V3.5.5enisa_euvdEU
Siemens APOGEE PXC Modular (P2 Ethernet)All versions → V2.8.20enisa_euvdEU
Siemens Nucleus NET≤ All versionsenisa_euvdEU
Siemens Nucleus ReadyStart V3All versions → V2017.02.3enisa_euvdEU
Siemens Nucleus ReadyStart V4All versions → V4.1.0enisa_euvdEU
Siemens Nucleus Source Code≤ Versions including affected DNS modulesenisa_euvdEU

showing 20 of 40

advisories (6)

Vendor and ecosystem advisories describing this.

SSA-180579SSA-180579: Privilege Management Vulnerability and Multiple Nucleus RTOS Vulnerabilities in APOGEE/TALON Field Panels before V3.5.5/V2.8.202022-12-13csaf · siemens_psirtDE
APOGEE PXC / TALON TC field panels (BACnet before V3.5.5 and P2 Ethernet before V2.8.20) contain multiple vulnerabilities: - CVE-2022-45937: A privilege management vulnerability that could allow low privilege authenticated attackers to gain high privilege access. - CVE-2020-28388: Predictable Initial Sequence Numbers in the TCP/IP Stack of Nucleus RTOS (real-time operating system) used by the affected products. - Several vulnerabilities in the DNS (domain name service) implementation of Nucleus RTOS. Siemens has released updates for the affected products and recommends to update to the latest versions.
SSA-669158SSA-669158: DNS Client Vulnerabilities in SIMOTICS CONNECT 4002021-04-13csaf · siemens_psirtDE
SIMOTICS CONNECT 400 is affected by DNS Client vulnerabilities as initially reported in Siemens Security Advisory SSA-705111 (https://cert-portal.siemens.com/productcert/pdf/ssa-705111.pdf) for the DNS Module in Nucleus RTOS. Siemens has released updates for the SIMOTICS CONNECT 400 and recommends to update to the latest version.
SSA-705111SSA-705111: Multiple Vulnerabilities (NAME:WRECK) in the DNS Module of Nucleus RTOS2021-04-13csaf · siemens_psirtDE
Security researchers discovered and disclosed 9 vulnerabilities in several DNS implementations, also known as “NAME:WRECK” vulnerabilities. The vulnerabilities described in this advisory are from this set. The DNS client of affected products contains multiple vulnerabilities related to the handling of DNS responses and requests. The most severe could allow an attacker to manipulate the DNS responses and cause a denial-of-service condition. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not available.
WID-SEC-W-2023-1986NAME:WRECK: Mehrere Schwachstellen in TCP/IP StacksDeutsch2021-04-15csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Siemens Nucleus Net, Siemens Nucleus RTOS, Microsoft Azure RTOS NetX und Wind River VxWorks ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen oder einen Denial of Service zu verursachen.
ICSA-21-103-13Siemens SIMOTICS CONNECT 400 (Update A)2021-04-13icsa · cisa_csaf_otUS
SIMOTICS CONNECT 400 is affected by DNS Client vulnerabilities as initially reported in Siemens Security Advisory SSA-705111 (https://cert-portal.siemens.com/productcert/pdf/ssa-705111.pdf) for the DNS Module in Nucleus RTOS. Siemens has released updates for the SIMOTICS CONNECT 400 and recommends to update to the latest version.
ICSA-22-349-16Siemens APOGEE and TALON2022-12-13icsa · cisa_csaf_otUS
APOGEE PXC / TALON TC field panels (BACnet before V3.5.5 and P2 Ethernet before V2.8.20) contain multiple vulnerabilities: - CVE-2022-45937: A privilege management vulnerability that could allow low privilege authenticated attackers to gain high privilege access. - CVE-2020-28388: Predictable Initial Sequence Numbers in the TCP/IP Stack of Nucleus RTOS (real-time operating system) used by the affected products. - Several vulnerabilities in the DNS (domain name service) implementation of Nucleus RTOS. Siemens has released updates for the affected products and recommends to update to the latest versions.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund cisa_csaf_ot siemens_psirt NVD CVE.org MITRE

published 2021-04-22modified 2026-06-17

related (11,872)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-11645US	—OT critical	2.44% (84th)	KEV	2026-06-09
Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium…
CVE-2026-3055US	critical9.8OT critical	91.5% (100th)	KEV	2026-03-23
Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP leading to memory overread
CVE-2025-5777US	high7.5OT critical	100.0% (100th)	KEV	2025-06-17
Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server
CVE-2025-5419US	—OT critical	7.82% (95th)	KEV	2025-06-03
Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium secur…
CVE-2025-24991US	—OT critical	2.02% (81st)	KEV	2025-03-11
Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally.

+11867 more

references (13)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan