Multiple Embedded TCP/IP Stacks (Update B)

🗓️ 11 Feb 2021 00:00:00Reported by Industrial Control Systems Cyber Emergency Response TeamType

ics🔗 www.cisa.gov👁 88 Views

Multiple Embedded TCP/IP Stacks (Update B). Advisory on vulnerabilities in open-source and proprietary TCP/IP stacks including Nut/Net, CycloneTCP, NDKTCPIP, FNET, uIP-Contiki-OS, uC/TCP-IP, and others, allowing for spoofing or disrupting TCP connections

Reporter	Title	Published	Views	Family All 100
ATTACKERKB	CVE-2020-27213	10 Oct 202317:15	–	attackerkb
BDU FSTEC	The vulnerability of the ISN IP pool generator implementation used in NutOS and Nut/Net arises from the use of insufficiently random values, allowing an intruder to gain unauthorized access to protected information.	4 Mar 202100:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the implementation of the ISN generator in the protocols used by uC/OS and uC/TCP-IP allows a perpetrator to gain unauthorized access to protected information.	4 Mar 202100:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the implementation of the ISN generator for the CycloneTCP protocol allows a perpetrator to gain unauthorized access to protected information.	9 Mar 202100:00	–	bdu_fstec
BDU FSTEC	The vulnerability in the implementation of the ISN generator for the TI-NDKTCPIP protocol allows a perpetrator to gain unauthorized access to protected information.	9 Mar 202100:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the implementation of the ISN generator in the FNET protocol stack allows a perpetrator to gain unauthorized access to protected information.	9 Mar 202100:00	–	bdu_fstec
BDU FSTEC	The vulnerability in the implementation of the ISN generator of the protocol stack used in Contiki OS and uIP allows a perpetrator to gain unauthorized access to protected information.	9 Mar 202100:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the implementation of the ISN generator for the PicoTCP protocol stack allows a perpetrator to gain unauthorized access to protected information.	9 Mar 202100:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the ISN generator implementation in MPLAB Net protocols allows a perpetrator to gain unauthorized access to protected information.	9 Mar 202100:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the ISN Handler TCP connection processing component in Siemens’ software and hardware products allows attackers to intercept existing sessions.	22 May 202300:00	–	bdu_fstec

Source	Link
raw	www.raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2021/icsa-21-042-01.json
cisa	www.cisa.gov/news-events/ics-advisories/icsa-21-042-01
us-cert	www.us-cert.cisa.gov/ics/alerts/ICS-ALERT-10-301-01
us-cert	www.us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
us-cert	www.us-cert.cisa.gov/ics/tips/ICS-TIP-12-146-01B

11 Feb 2021 00:00Current

8.4High risk

Vulners AI Score8.4

CVSS 3.16.5 - 9.8

CVSS 25

EPSS0.00422

SSVC

vulnerabilities in tcp/ip. open-source tcp/ip stacks. spoofing attacks. denial-of-service. initial sequence numbers. mitigations. update information. risk evaluation. nut/net. cyclonetcp. ndktcpip. fnet. uip-contiki-os. uc/tcp-ip. picotcp. mplab net. nucleus net. nucleus readystart. cwe-330. cvss v3. linear congruential generator. publicly recoverable information. security advisory.