Summary
The networking component (Nucleus NET) in Nucleus Real-Time Operating System (RTOS) use Initial Sequence Numbers for TCP-Sessions that are predictable.
Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not available.
Vulnerabilities 1
-
Medium 6.5
A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethe…
Revision history
-
#3
Removed Capital VSTAR as it is not affected by CVE-2022-28388
-
#2
Consolidated list of products
-
#1
Publication Date
References
-
SSA-362164: Predictable Initial Sequence Numbers in the TCP/IP Stack of Nucleus RTOS - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-362164.pdf
-
SSA-362164: Predictable Initial Sequence Numbers in the TCP/IP Stack of Nucleus RTOS - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-362164.txt