CVE-2020-35685

mediumpriority · track · 37OT risk · elevatedstack campaign · INFRA:HALTEPSS 0.021 · 81 %ileDEEURUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
2.05% (81st) EPSS
CVSS 6.4 · medium
Is it mine?
29 products
Check your exposure
Who says so?
8 sources
cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · scored 2026-10-27

An issue was discovered in HCC Nichestack 3.0. The code that generates Initial Sequence Numbers (ISNs) for TCP connections derives the ISN from an insufficiently random source. As a result, an attacker may be able to determine the ISN of current and future TCP connections and either hijack existing ones or spoof future ones. (Proper ISN generation should aim to follow at least the specifications outlined in RFC 6528.)

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • FixedSENTRON 3WA COM190siemens_psirt

    Update to V2.0.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109782123/
  • FixedSENTRON 3WL COM35siemens_psirt

    Update to V1.2.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109766651/
  • FixedSENTRON 7KM PAC Switched Ethernet PROFINET Expansion Modulesiemens_psirt

    Update to V2.1.6 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109749555/
  • Fixedpilz_psirt

    | Produkt | Maßnahme | |----------------------------------------------|------------------------------------------------------| | PSSu-Module für dezentrales E/A-System | siehe Mitigation | | PSSu-Module für PSS 4000 | Firmware auf 1.22.2 aktualisieren * | | PNOZ m B1 | siehe Mitigation ** | | PNOZ m ES ETH | siehe Mitigation ** | | PNOZ mmc1p ETH | siehe Mitigation | | Base-Device PNOZ mxp ETH (PNOZmulti Classic) | siehe Mitigation | \* CVE-2020-35685 wird in diesem Update nicht behoben, da es keine Auswirkungen auf die Sicherheit der verwendeten Dienste und Protokolle (MODBUS/TCP und RAW-TCP) hat. \** Diese Produkte sind im Feld nicht updatefähig. Sie verwenden eine vom Hersteller vorinstallierte, feste Firmware.

  • Fixedphoenix_contact_psirt

    Phoenix Contact Classic Line Controllers are designed and developed for the use in closed industrial networks. The control and configuration protocols do not feature authentication mechanisms by design. Phoenix Contact therefore strongly recommends using the devices exclusively in closed networks and protected by a suitable firewall. Phoenix Contact is offering the mGuard product family for network segmentation and protection.

  • FixedInterNiche stackcisa_csaf_ot

    Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:

    https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-022_en.pdf
  • FixedNicheLitecisa_csaf_ot

    Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:

    https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-022_en.pdf
  • Mitigationpilz_psirt

    It is adviced to use firewalls or similar network security devices to prevent unauthorized network communication to the products affected.

  • Mitigationphoenix_contact_psirt

    Customers using Phoenix Contact Classic Line Controllers are strongly recommended to operate the devices in closed networks or protected with a suitable firewall as intended. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our application note: Measures to protect network-capable devices with Ethernet connection

  • No fix plannedSENTRON 7KM PAC Switched Ethernet PROFINET Expansion Modulesiemens_psirt

    Currently no remediation is planned

02

cvss

Technical severity, 0–10. One row per scoring source.

9.1
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–critical · 6.4–9.1

v2.06.4mediumAV:N/AC:L/Au:N/C:P/I:P/A:Nprimary · NVD / NIST USexploitability 10 · impact 4.9
v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nprimary · NVD / NIST USexploitability 3.9 · impact 5.2
v3.07.5highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Nsecondary · CISA US
v3.17.5highAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Nsecondary · FSTEC (BDU) RU
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:Csecondary · Siemens ProductCERT DE
v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · Phoenix Contact PSIRT DE
v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · Pilz PSIRT DE
v3.18.3highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)
03

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-330USprimaryCWE-330USCWE-330USCWE-330USCWE-330USCWE-330USCWE-451US
04

affected products (29)

Products and version ranges known to be affected.

showing 20 of 29
05

advisories (4)

Vendor and ecosystem advisories describing this.

  • SSA-789208SSA-789208: Multiple Vulnerabilities (INFRA:HALT) in Interniche IP-Stack based Low Voltage Devices2021-08-04csaf · siemens_psirtDE

    Security researchers discovered and disclosed 14 vulnerabilities in the Interniche IP stack, also known as "INFRA:HALT" vulnerabilities [0]. This advisory describes the impact to Siemens low voltage products, which are only affected by four out of the 14 vulnerabilities. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available. [0] https://www.forescout.com/blog/new-critical-operational-technology-vulnerabilities-found-on-nichestack/

  • VDE-2021-009Pilz: Multiple products prone to Niche Ethernet Stack vulnerabilities2021-09-20csaf · pilz_psirtDE

    Multiple products of PILZ utilise a third-party TCP/IP implementation - the "Niche Ethernet Stack". This TCP/IP stack contains multiple vulnerabilities which are therefore affecting the products listed above.

  • VDE-2021-032PHOENIX CONTACT: Niche Ethernet Stack for ILC1x0, ILC1x1 and AXC 1050 Industrial controllers and CHARX control DC2021-08-04csaf · phoenix_contact_psirtDE

    Third party Niche Ethernet stack has several vulnerabilities announced by the security researcher's community. Phoenix Contact Classic Line industrial controllers are developed and designed for the use in closed industrial networks. The communication protocols and device access do not feature authentication measures. Remote attackers can use specially crafted IP packets to cause a Denial of Service or a Breach of Integrity of the PLC.

  • ICSA-21-217-01HCC Embedded InterNiche TCP/IP stack, NicheLite (Update B)2021-08-05icsa · cisa_csaf_otUS

    Successful exploitation of these vulnerabilities may result in unauthorized access to arbitrary information, DNS cache poisoning, remote code execution, or a denial-of-service condition.

06

also known as (4)

Other names and identifiers for this entity.

07

sources

Which sources assert this record, and when.

cnnvdenisa_euvdfstec_bducisa_csaf_otnvdphoenix_contact_psirtpilz_psirtsiemens_psirtNVDCVE.orgMITRE
published 2021-08-19modified 2026-06-17
09

references (16)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan