Skip to content
OpenAdvisories
High ICSA-21-042-01 9 CVEs

Multiple Embedded TCP/IP Stacks (Update B)

Published Feb 11, 2021 · Updated Nov 11, 2021 · Revision 3

Vendor: multiple Product: Capital VSTAR Product: CycloneTCP Product: FNET Product: MPLAB Net Product: NDKTCPIP Product: Nucleus NET All Product: Nucleus ReadyStart for ARM MIPS and PPC Product: Nucleus Source Code Product: Nut/Net Product: picoTCP (EOL) Product: picoTCP-NG Product: uC/TCP-IP (EOL) Product: uIP (EOL) Product: uIP-Contiki-NG Product: uIP-Contiki-OS (end-of-life [EOL])

Summary

Successful exploitation of weak initial sequence numbers (ISN) can be used to hijack or spoof TCP connections, cause denial-of-service conditions, inject malicious data, or bypass authentication.

Vulnerabilities 9

  • Medium 6.5
    CVE-2020-28388

    A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethe…

    Siemens TALON TC Modular (BACnet) APOGEE PXC Compact (BACnet) APOGEE PXC Modular (BACnet) ICS / OT
  • Unscored —
    CVE-2020-27213

    An issue was discovered in Ethernut Nut/OS 5.1. The code that generates Initial Sequence Numbers (ISNs) for TCP connect…

  • Unscored —
    CVE-2020-27630

    In Silicon Labs uC/TCP-IP 3.6.0, TCP ISNs are improperly random.

  • Unscored —
    CVE-2020-27631

    In Oryx CycloneTCP 1.9.6, TCP ISNs are improperly random.

  • Unscored —
    CVE-2020-27632

    In SIMATIC MV400 family versions prior to v7.0.6, the ISN generator is initialized with a constant value and has consta…

  • Unscored —
    CVE-2020-27633

    In FNET 4.6.3, TCP ISNs are improperly random.

  • Unscored —
    CVE-2020-27634

    In Contiki 4.5, TCP ISNs are improperly random.

  • Unscored —
    CVE-2020-27635

    In PicoTCP 1.7.0, TCP ISNs are improperly random.

  • Unscored —
    CVE-2020-27636

    In Microchip MPLAB Net 3.6.1, TCP ISNs are improperly random.

Revision history

  1. #3

    ICSA-21-042-01 Multiple Embedded TCP-IP stacks (Update B)

  2. #2

    ICSA-21-042-01 Multiple Embedded TCP/IP stacks (Update A)

  3. #1

    ICSA-21-042-01 Multiple Embedded TCP/IP stacks

References