Critical severity · published Aug 19, 2021
CVE-2020-35685
An issue was discovered in HCC Nichestack 3.0
9.1
CVSS
2.1%
EPSS
No
On KEV
Description
An issue was discovered in HCC Nichestack 3.0. The code that generates Initial Sequence Numbers (ISNs) for TCP connections derives the ISN from an insufficiently random source. As a result, an attacker may be able to determine the ISN of current and future TCP connections and either hijack existing ones or spoof future ones. (Proper ISN generation should aim to follow at least the specifications outlined in RFC 6528.)
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NI
Nichestack · Hcc-embedded
3.0 · source: NVD
S3
Sentron 3wa Com190 Firmware · Siemens
before 2.0.0 · source: NVD
S3
Sentron 3wl Com35 Firmware · Siemens
before 1.2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-35685
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-35685
Mitigation
https://cert-portal.siemens.com/productcert/pdf/ssa-789208.pdf
Mitigation
https://www.forescout.com/blog/new-critical-operational-technology-vulnerabilities-found-on-nichestack/
Product
https://www.hcc-embedded.com
Third Party Advisory
https://www.kb.cert.org/vuls/id/608209
More from Nichestack
7.5
CVE-2021-36762
An issue was discovered in HCC Embedded InterNiche NicheStack through 4.3
7.5
CVE-2021-31401
An issue was discovered in tcp_rcv() in nptcp.c in HCC embedded InterNiche 4.0.1
7.5
CVE-2021-27565
The web server in InterNiche NicheStack through 4.0.1 allows remote attackers to cause a denial of service (infinite loop and networking outage) via an unexpected valid HTTP…
7.5
CVE-2020-35684
An issue was discovered in HCC Nichestack 3.0
7.5
CVE-2020-35683
An issue was discovered in HCC Nichestack 3.0