Description
An issue was discovered in tcp_pulloutofband() in tcp_in.c in HCC embedded InterNiche 4.0.1. The TCP out-of-band urgent-data processing function invokes a panic function if the pointer to the end of the out-of-band data points outside of the TCP segment's data. If the panic function hadn't a trap invocation removed, it will enter an infinite loop and therefore cause DoS (continuous loop or a device reset).
Advisories 4
- VDE-2021-032 PHOENIX CONTACT: Niche Ethernet Stack for ILC1x0, ILC1x1 and AXC 1050 Industrial controllers and CHARX control DC CERT@VDE · May 22, 2025
- VDE-2021-009 Pilz: Multiple products prone to Niche Ethernet Stack vulnerabilities CERT@VDE · May 14, 2025
- SEVD-2021-217-01 NicheStack TCP/IP Vulnerabilities (INFRA:HALT) in Lexium ILE, ILA, ILS, and Communication Option Boards for Altivar and Lexium32 drives Schneider Electric CPCERT · May 9, 2023
- ICSA-21-217-01 HCC Embedded InterNiche TCP/IP stack, NicheLite (Update B) CISA ICS & IT advisories · Dec 16, 2021