Design/Logic Flaw

The DNS client in InterNiche NicheStack TCP/IP 4.0.1 is affected by: Insufficient entropy in the DNS transaction id. The impact is: DNS cache poisoning remote. The component is: dnsquerytype. The attack vector is: a specific DNS response packet...

CVE-2020-25928

The DNS feature in InterNiche NicheStack TCP/IP 4.0.1 is affected by: Buffer Overflow. The impact is: execute arbitrary code remote. The component is: DNS response processing functions: dnsupcall, getoffset, dncsetanswer. The attack vector is: a specific DNS response packet. The code does not che...

CVE-2020-25928

The CVE-2020-25928 issue is in HCC Embedded’s InterNiche/NicheStack DNS response processing. The vulnerability stems from not validating the length of DNS answer data, which can cause out-of-bounds reads/writes in dns_upcall(), getoffset(), and dnc_set_answer(). This can enable information leakag...

CVE-2020-25767

An issue was discovered in HCC Embedded NicheStack IPv4 4.1. The dnccopyin routine for parsing DNS domain names does not check whether a domain name compression pointer is pointing within the bounds of the packet e.g., forward compression pointer jumps are allowed, which leads to an Out-of-bounds...

CVE-2020-25767

CVE-2020-25767 affects HCC Embedded InterNiche/NicheStack (IPv4) prior to 4.3. The root cause is in the dnc_copy_in DNS domain name parser, which fails to validate that compression pointers stay within packet bounds, enabling an out-of-bounds read and potential DoS via crafted DNS data. Affected ...

CVE-2020-25927

The DNS feature in InterNiche NicheStack TCP/IP 4.0.1 is affected by: Out-of-bounds Read. The impact is: a denial of service remote. The component is: DNS response processing in function: dnsupcall. The attack vector is: a specific DNS response packet. The code does not check whether the number o...

CVE-2020-25927

CVE-2020-25927 targets InterNiche/NicheStack TCP/IP (pre-4.3). The DNS response processing path dns_upcall() does not validate the DNS header’s query/response counts against the packet data, causing an out-of-bounds read and potential remote DoS. The ICS/CISA advisory Update B lists this issue am...

CVE-2020-25926

The DNS client in InterNiche NicheStack TCP/IP 4.0.1 is affected by: Insufficient entropy in the DNS transaction id. The impact is: DNS cache poisoning remote. The component is: dnsquerytype. The attack vector is: a specific DNS response packet...

CVE-2020-25926

Summary of CVE-2020-25926 (INFRA:HALT) in HCC Embedded/NicheStack: The DNS client in InterNiche NicheStack TCP/IP (pre-4.3) suffers from insufficient entropy in DNS transaction IDs, enabling remote DNS cache poisoning via specially crafted responses. The related ICS/National advisories enumerate ...

CVE-2020-25928: Out-of-bounds Read

The DNS feature in InterNiche NicheStack TCP/IP 4.0.1 is affected by: Buffer Overflow. The impact is: execute arbitrary code remote. The component is: DNS response processing functions: dnsupcall, getoffset, dncsetanswer. The attack vector is: a specific DNS response packet. The code does not che...

CVE-2020-25926: Insufficient Entropy

The DNS client in InterNiche NicheStack TCP/IP 4.0.1 is affected by: Insufficient entropy in the DNS transaction id. The impact is: DNS cache poisoning remote. The component is: dnsquerytype. The attack vector is: a specific DNS response packet...

CVE-2020-25767: Out-of-bounds Read

An issue was discovered in HCC Embedded NicheStack IPv4 4.1. The dnccopyin routine for parsing DNS domain names does not check whether a domain name compression pointer is pointing within the bounds of the packet e.g., forward compression pointer jumps are allowed, which leads to an Out-of-bounds...

CVE-2020-25927: Out-of-bounds Read

The DNS feature in InterNiche NicheStack TCP/IP 4.0.1 is affected by: Out-of-bounds Read. The impact is: a denial of service remote. The component is: DNS response processing in function: dnsupcall. The attack vector is: a specific DNS response packet. The code does not check whether the number o...

NicheStack embedded TCP/IP has vulnerabilities

Overview HCC Embedded's software called InterNiche stack NicheStack and NicheLite, which provides TCP/IP networking capability to embedded systems, is impacted by multiple vulnerabilities. The Forescout and JFrog researchers who discovered this set of vulnerabilities have identified these as...

HCC Embedded InterNiche Technologies NicheStack Input Validation Error Vulnerability (CNVD-2021-58800)

InterNiche Technologies NicheStack is a small footprint, RFC-compliant embedded stack that is portable to commercial or proprietary non-MMU operating systems. InterNiche Technologies NicheStack suffers from an input validation error vulnerability that exists due to insufficient validation of...

HCC Embedded InterNiche Technologies NicheStack Input Validation Error Vulnerability

InterNiche Technologies NicheStack is a small footprint, RFC-compliant embedded stack that is portable to commercial or proprietary non-MMU operating systems. InterNiche Technologies NicheStack suffers from an input validation error vulnerability that stems from a boundary condition in the ICMP...

Critical Flaws Affect Embedded TCP/IP Stack Widely Used in Industrial Control Devices

Cybersecurity researchers on Wednesday disclosed 14 vulnerabilities affecting a commonly-used TCP/IP stack used in millions of Operational Technology OT devices manufactured by no fewer than 200 vendors and deployed in manufacturing plants, power generation, water treatment, and critical...

HCC Embedded InterNiche 缓冲区错误漏洞

InterNiche Technologies NicheStack is a small footprint, RFC-compliant embedded stack that is portable to commercial or proprietary non-MMU operating systems. InterNiche Technologies NicheStack suffers from an input validation error vulnerability that stems from a boundary condition in the ICMP...

HCC Embedded InterNiche 输入验证错误漏洞

InterNiche Technologies NicheStack is a small footprint, RFC-compliant embedded stack that is portable to commercial or proprietary non-MMU operating systems. InterNiche Technologies NicheStack suffers from an input validation error vulnerability that exists due to insufficient validation of...

PT-2021-3861 · Hcc Embedded · Nichestack

Name of the Vulnerable Software and Affected Versions: HCC Embedded InterNiche NicheStack versions through 4.3 Description: The issue is related to errors in handling TFTP packet processing in the NicheLite and InterNiche TCP/IP stacks, specifically with null-termination of strings or arrays. Thi...