CVE-2020-35685

Katalog CVE

CVSS 9.1 · Critical EPSS 2,1%

Kerentanan Use of Insufficiently Random Values pada hcc-embedded nichestack, siemens sentron 3wa com190 firmware +1 lainnya. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

An issue was discovered in HCC Nichestack 3.0. The code that generates Initial Sequence Numbers (ISNs) for TCP connections derives the ISN from an insufficiently random source. As a result, an attacker may be able to determine the ISN of current and future TCP connections and either hijack existing ones or spoof future ones. (Proper ISN generation should aim to follow at least the specifications outlined in RFC 6528.)

Rincian

Terbit di NVD

19 Agustus 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-330: Use of Insufficiently Random Values

EPSS (30 hari)

2,1% peluang dieksploitasi; lebih tinggi dari 80,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://cert-portal.siemens.com/productcert/pdf/ssa-789208.pdf mitigasi · advisory pihak ketiga
• https://www.forescout.com/blog/new-critical-operational-technology-vulnerabilities-found-on-nichestack/ mitigasi · advisory pihak ketiga
• https://www.kb.cert.org/vuls/id/608209 advisory pihak ketiga · pemerintah AS
• https://www.hcc-embedded.com product