Multiple Siemens products incorrectly zero-terminated vulnerabilities

The Nucleus NET module integrates a range of standards-compliant networking and communications protocols, drivers and utilities to provide full-featured networking support in any embedded device. A security vulnerability exists in several Siemens products, which stems from the DHCP client application assuming that the data provided with the “hostname” DHCP option NULL is terminated. An attacker could exploit the vulnerability to cause out-of-bounds reads, out-of-bounds writes, and denial-of-service conditions.