Description
An issue was discovered in HCC Nichestack 3.0. The code that generates Initial Sequence Numbers (ISNs) for TCP connections derives the ISN from an insufficiently random source. As a result, an attacker may be able to determine the ISN of current and future TCP connections and either hijack existing ones or spoof future ones. (Proper ISN generation should aim to follow at least the specifications outlined in RFC 6528.)
Advisories 5
- VDE-2021-032 PHOENIX CONTACT: Niche Ethernet Stack for ILC1x0, ILC1x1 and AXC 1050 Industrial controllers and CHARX control DC CERT@VDE · May 22, 2025
- VDE-2021-009 Pilz: Multiple products prone to Niche Ethernet Stack vulnerabilities CERT@VDE · May 14, 2025
- SEVD-2021-217-01 NicheStack TCP/IP Vulnerabilities (INFRA:HALT) in Lexium ILE, ILA, ILS, and Communication Option Boards for Altivar and Lexium32 drives Schneider Electric CPCERT · May 9, 2023
- SSA-789208 SSA-789208: Multiple Vulnerabilities (INFRA:HALT) in Interniche IP-Stack based Low Voltage Devices Siemens ProductCERT · Jan 11, 2022
- ICSA-21-217-01 HCC Embedded InterNiche TCP/IP stack, NicheLite (Update B) CISA ICS & IT advisories · Dec 16, 2021