Description
An issue was discovered in tcp_rcv() in nptcp.c in HCC embedded InterNiche 4.0.1. The TCP header processing code doesn't sanitize the value of the IP total length field (header length + data length). With a crafted IP packet, an integer overflow occurs whenever the value of the IP data length is calculated by subtracting the length of the header from the total length of the IP packet.
Advisories 6
- VDE-2021-032 PHOENIX CONTACT: Niche Ethernet Stack for ILC1x0, ILC1x1 and AXC 1050 Industrial controllers and CHARX control DC CERT@VDE · May 22, 2025
- VDE-2021-009 Pilz: Multiple products prone to Niche Ethernet Stack vulnerabilities CERT@VDE · May 14, 2025
- VDE-2021-042 Weidmueller: Remote I/O fieldbus couplers (IP20) affected by INFRA:HALT vulnerabilities CERT@VDE · May 14, 2025
- SEVD-2021-217-01 NicheStack TCP/IP Vulnerabilities (INFRA:HALT) in Lexium ILE, ILA, ILS, and Communication Option Boards for Altivar and Lexium32 drives Schneider Electric CPCERT · May 9, 2023
- SSA-789208 SSA-789208: Multiple Vulnerabilities (INFRA:HALT) in Interniche IP-Stack based Low Voltage Devices Siemens ProductCERT · Jan 11, 2022
- ICSA-21-217-01 HCC Embedded InterNiche TCP/IP stack, NicheLite (Update B) CISA ICS & IT advisories · Dec 16, 2021