Siemens Nucleus RTOS TCP/IP Stack

🗓️ 09 Nov 2021 00:00:00Reported by Industrial Control Systems Cyber Emergency Response TeamType

ics🔗 www.cisa.gov👁 45 Views

Siemens Nucleus RTOS TCP/IP Stack vulnerabilities: Type Confusion, Improper Validation, Out-of-bounds Read, Improper Restriction, Null Termination, Buffer Access, Integer Underflow, and Inconsistent Handling

Reporter	Title	Published	Views	Family All 165
Android Security Bulletins	Android Security Bulletin—January 2022Stay organized with collectionsSave and categorize content based on your preferences.	4 Jan 202200:00	–	androidsecurity
BDU FSTEC	The vulnerability in the DHCP service of the microprogramming software for controllers APOGEE MBC, APOGEE MEC, APOGEE PXC, TALON TC, and the operating system Nucleus allows a perpetrator to trigger read errors, write errors, and service failures.	19 Nov 202100:00	–	bdu_fstec
BDU FSTEC	The vulnerability of microprogrammed software for controllers CAPITAL VSTAR, APOGEE MBC, APOGEE MEC, APOGEE PXC, TALON TC, and the operating system Nucleus relates to errors in processing SACK TCP packets. This vulnerability allows an attacker to gain access to protected information or cause service interruptions.	9 Mar 202200:00	–	bdu_fstec
BDU FSTEC	The vulnerability of Siemens’ TFTP-server implementation for software and software-hardware products arises from the operation that goes beyond buffer boundaries in memory, allowing attackers to gain access to protected information.	20 Apr 202200:00	–	bdu_fstec
BDU FSTEC	The vulnerability of FTP servers for microprogrammed software controllers such as CAPITAL VSTAR, APOGEE MBC, APOGEE MEC, APOGEE PXC, TALON TC, and the operating system Nucleus allows a hacker to cause a service failure or execute arbitrary code.	20 Apr 202200:00	–	bdu_fstec
BDU FSTEC	The vulnerability of FTP servers for microprogrammed software controllers such as CAPITAL VSTAR, APOGEE MBC, APOGEE MEC, APOGEE PXC, TALON TC, and the operating system Nucleus allows a hacker to cause service failures or execute arbitrary codes.	20 Apr 202200:00	–	bdu_fstec
BDU FSTEC	The vulnerability of microprogrammed software for controllers CAPITAL VSTAR, APOGEE MBC, APOGEE MEC, APOGEE PXC, TALON TC, and the operating system Nucleus relates to errors in processing ICMP packet headers. This vulnerability allows attackers to gain access to protected information or cause service interruptions.	20 Apr 202200:00	–	bdu_fstec
BDU FSTEC	The vulnerability of microprogrammed software for controllers CAPITAL VSTAR, APOGEE MBC, APOGEE MEC, APOGEE PXC, TALON TC, and the operating system Nucleus relates to errors in processing UDP packet headers. This vulnerability allows an attacker to gain access to protected information or cause a service failure.	20 Apr 202200:00	–	bdu_fstec
BDU FSTEC	The vulnerability of FTP servers for microprogrammed software controllers such as CAPITAL VSTAR, APOGEE MBC, APOGEE MEC, APOGEE PXC, TALON TC, and the operating system Nucleus allows a hacker to cause service failures or execute arbitrary codes.	20 Apr 202200:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the DHCP service provided by microprogramming software for controllers such as APOGEE MBC, APOGEE MEC, APOGEE PXC, Desigo PXC, TALON TC, and the operating system Nucleus allows a perpetrator to trigger a service failure.	26 Jun 202300:00	–	bdu_fstec

Source	Link
cert-portal	www.cert-portal.siemens.com/productcert/csaf/ssa-044112.json
cert-portal	www.cert-portal.siemens.com/productcert/txt/ssa-044112.txt
cert-portal	www.cert-portal.siemens.com/productcert/pdf/ssa-044112.pdf
raw	www.raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2021/icsa-21-313-03.json
cisa	www.cisa.gov/news-events/ics-advisories/icsa-21-313-03
cisa	www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
cisa	www.cisa.gov/resources-tools/resources/ics-recommended-practices
cisa	www.cisa.gov/topics/industrial-control-systems
us-cert	www.us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
cisa	www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

09 Nov 2021 00:00Current

9.5High risk

Vulners AI Score9.5

CVSS 27.5

CVSS 3.18.2 - 9.8

CVSS 46.9

EPSS0.03395