Lucene search

[email protected]CVE-2020-25241

HistoryMar 15, 2021 - 5:15 p.m.

CVE-2020-25241

2021-03-1517:15:00

CWE-129

[email protected]

web.nvd.nist.gov

simatic mv400

vulnerability

cve-2020-25241

tcp stack

security问题

nvd

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.4 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.001 Low

EPSS

Percentile

42.3%

JSON

A vulnerability has been identified in SIMATIC MV400 family (All Versions < V7.0.6). The underlying TCP stack of the affected products does not correctly validate the sequence number for incoming TCP RST packages. An attacker could exploit this to terminate arbitrary TCP sessions.

CPENameOperatorVersion
siemens:simatic_mv440_sr_firmwaresiemens simatic mv440 sr firmwarelt7.0.6
siemens:simatic_mv440_hr_firmwaresiemens simatic mv440 hr firmwarelt7.0.6
siemens:simatic_mv440_ur_firmwaresiemens simatic mv440 ur firmwarelt7.0.6
siemens:simatic_mv420_sr-b_firmwaresiemens simatic mv420 sr-b firmwarelt7.0.6
siemens:simatic_mv420_sr-p_firmwaresiemens simatic mv420 sr-p firmwarelt7.0.6
siemens:simatic_mv420_sr-b_body_firmwaresiemens simatic mv420 sr-b body firmwarelt7.0.6
siemens:simatic_mv420_sr-p_body_firmwaresiemens simatic mv420 sr-p body firmwarelt7.0.6

CPE	Name	Operator	Version
siemens:simatic_mv440_sr_firmware	siemens simatic mv440 sr firmware	lt	7.0.6
siemens:simatic_mv440_hr_firmware	siemens simatic mv440 hr firmware	lt	7.0.6
siemens:simatic_mv440_ur_firmware	siemens simatic mv440 ur firmware	lt	7.0.6
siemens:simatic_mv420_sr-b_firmware	siemens simatic mv420 sr-b firmware	lt	7.0.6
siemens:simatic_mv420_sr-p_firmware	siemens simatic mv420 sr-p firmware	lt	7.0.6
siemens:simatic_mv420_sr-b_body_firmware	siemens simatic mv420 sr-b body firmware	lt	7.0.6
siemens:simatic_mv420_sr-p_body_firmware	siemens simatic mv420 sr-p body firmware	lt	7.0.6

References

cert-portal.siemens.com/productcert/pdf/ssa-599268.pdf

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.4 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.001 Low

EPSS

Percentile

42.3%

JSON

Related for CVE-2020-25241

cvelist1 prion1 ics1