{
  "document": {
    "acknowledgments": [
      {
        "organization": "Siemens ProductCERT",
        "summary": "reporting this vulnerability to CISA."
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "general",
        "text": "Operators of critical power systems (e.g.\u0027TSOs or DSOs) worldwide are usually required by regulations to build resilience into the power grids by applying multi-level redundant secondary protection schemes. It is therefore recommended that the operators check whether appropriate resilient protection measures are in place. The risk of cyber incidents impacting the grid\u0027s reliability can thus be minimized by virtue of the grid design. Siemens strongly recommends applying the provided security updates using the corresponding tooling and documented procedures made available with the product. If supported by the product, an automated means to apply the security updates across multiple product instances may be used. Siemens strongly recommends prior validation of any security update before being applied, and supervision by trained staff of the update process in the target environment. As a general security measure Siemens strongly recommends to protect network access with appropriate mechanisms (e.g.\u0027firewalls, segmentation, VPN). It is advised to configure the environment according to our operational guidelines in order to run the devices in a protected IT environment.",
        "title": "General Recommendations"
      },
      {
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
        "title": "Terms of Use"
      },
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "other",
        "text": "This CISA CSAF advisory was converted from a Siemens ProductCERT\u0027s advisory.",
        "title": "Advisory Conversion Disclaimer"
      },
      {
        "category": "other",
        "text": "Multiple",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "Germany",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "central@cisa.dhs.gov",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-344238: TCP Session Hijacking Vulnerability in Siemens Energy PLUSCONTROL 1st Gen\n        Devices - HTML Version",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-344238.html"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-21-068-08 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2021/icsa-21-068-08.json"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-21-068-08 - Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-068-08"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/topics/industrial-control-systems"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
      }
    ],
    "title": "Siemens Energy PLUSCONTROL 1st Gen",
    "tracking": {
      "current_release_date": "2021-03-09T00:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ICSA-21-068-08",
      "initial_release_date": "2021-03-09T00:00:00.000000Z",
      "revision_history": [
        {
          "date": "2021-03-09T00:00:00.000000Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Siemens PLUSCONTROL 1st Gen: All versions",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "PLUSCONTROL 1st Gen"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-28388",
      "cwe": {
        "id": "CWE-342",
        "name": "Predictable Exact Value from Previous Values"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Initial Sequence Numbers (ISNs) for TCP connections are derived from an insufficiently random source. As a result, the ISN of current and future TCP connections could be predictable. An attacker could hijack existing sessions or spoof future ones.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "PLUSCONTROL devices are typically located in a separate LAN segment of energy transmission solutions, where an attacker could use this vulnerability to disrupt SER messages or Trace functionalities. Therefore, review the status of the defense in depth recommendations that apply to your specific deployment and align as needed. Especially the measures on the network layer to prevent accessibility from other network segments.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2020-28388"
    }
  ]
}

{
  "document": {
    "acknowledgments": [
      {
        "organization": "Siemens ProductCERT",
        "summary": "reporting these vulnerabilities to CISA."
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "APOGEE PXC / TALON TC field panels (BACnet before V3.5.5 and P2 Ethernet before V2.8.20) contain multiple vulnerabilities:\n\n- CVE-2022-45937: A privilege management vulnerability that could allow low privilege authenticated attackers to gain high privilege access.\n- CVE-2020-28388: Predictable Initial Sequence Numbers in the TCP/IP Stack of Nucleus RTOS (real-time operating system) used by the affected products.\n- Several vulnerabilities in the DNS (domain name service) implementation of Nucleus RTOS.\n\nSiemens has released updates for the affected products and recommends to update to the latest versions.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure Siemens strongly recommends to protect network access to affected products with appropriate mechanisms. It is advised to follow recommended security practices in order to run the devices in a protected IT environment.",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
        "title": "Terms of Use"
      },
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "other",
        "text": "This CISA CSAF advisory was converted from Siemens ProductCERT\u0027s CSAF advisory.",
        "title": "Advisory Conversion Disclaimer"
      },
      {
        "category": "other",
        "text": "Multiple",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "Germany",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "central@cisa.dhs.gov",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-180579: Privilege Management Vulnerability and Multiple Nucleus RTOS Vulnerabilities in APOGEE/TALON Field Panels before V3.5.5/V2.8.20 - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-180579.json"
      },
      {
        "category": "self",
        "summary": "SSA-180579: Privilege Management Vulnerability and Multiple Nucleus RTOS Vulnerabilities in APOGEE/TALON Field Panels before V3.5.5/V2.8.20 - HTML Version",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-180579.html"
      },
      {
        "category": "self",
        "summary": "SSA-180579: Privilege Management Vulnerability and Multiple Nucleus RTOS Vulnerabilities in APOGEE/TALON Field Panels before V3.5.5/V2.8.20 - PDF Version",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-180579.pdf"
      },
      {
        "category": "self",
        "summary": "SSA-180579: Privilege Management Vulnerability and Multiple Nucleus RTOS Vulnerabilities in APOGEE/TALON Field Panels before V3.5.5/V2.8.20 - TXT Version",
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-180579.txt"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-22-349-16 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2022/icsa-22-349-16.json"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-22-349-16 - Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-22-349-16"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/topics/industrial-control-systems"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
      }
    ],
    "title": "Siemens APOGEE and TALON",
    "tracking": {
      "current_release_date": "2025-05-06T06:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ICSA-22-349-16",
      "initial_release_date": "2022-12-13T00:00:00.000000Z",
      "revision_history": [
        {
          "date": "2022-12-13T00:00:00.000000Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        },
        {
          "date": "2023-08-08T00:00:00.000000Z",
          "legacy_version": "1.1",
          "number": "2",
          "summary": "Added additional vulnerabilities that were fixed in the same product versions (V3.5.5 / V2.8.20)"
        },
        {
          "date": "2025-05-06T06:00:00.000000Z",
          "legacy_version": "Revision",
          "number": "3",
          "summary": "Revision - Fixing typos"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV3.5.5",
                "product": {
                  "name": "APOGEE PXC Compact (BACnet)",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "APOGEE PXC Compact (BACnet)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV2.8.20",
                "product": {
                  "name": "APOGEE PXC Compact (P2 Ethernet)",
                  "product_id": "CSAFPID-0002"
                }
              }
            ],
            "category": "product_name",
            "name": "APOGEE PXC Compact (P2 Ethernet)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV3.5.5",
                "product": {
                  "name": "APOGEE PXC Modular (BACnet)",
                  "product_id": "CSAFPID-0003"
                }
              }
            ],
            "category": "product_name",
            "name": "APOGEE PXC Modular (BACnet)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV2.8.20",
                "product": {
                  "name": "APOGEE PXC Modular (P2 Ethernet)",
                  "product_id": "CSAFPID-0004"
                }
              }
            ],
            "category": "product_name",
            "name": "APOGEE PXC Modular (P2 Ethernet)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV3.5.5",
                "product": {
                  "name": "TALON TC Compact (BACnet)",
                  "product_id": "CSAFPID-0005"
                }
              }
            ],
            "category": "product_name",
            "name": "TALON TC Compact (BACnet)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV3.5.5",
                "product": {
                  "name": "TALON TC Modular (BACnet)",
                  "product_id": "CSAFPID-0006"
                }
              }
            ],
            "category": "product_name",
            "name": "TALON TC Modular (BACnet)"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-15795",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The DNS domain name label parsing functionality does not properly validate the names in DNS-responses. The parsing of malformed responses could result in a write past the end of an allocated structure. An attacker with a privileged position in the network could leverage this vulnerability to execute code in the context of the current process or cause a denial-of-service condition.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.8.20 or later version",
          "product_ids": [
            "CSAFPID-0002",
            "CSAFPID-0004"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V3.5.5 or later version",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0005",
            "CSAFPID-0006"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006"
          ]
        }
      ],
      "title": "CVE-2020-15795"
    },
    {
      "cve": "CVE-2020-27009",
      "cwe": {
        "id": "CWE-823",
        "name": "Use of Out-of-range Pointer Offset"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The DNS domain name record decompression functionality does not properly validate the pointer offset values. The parsing of malformed responses could result in a write past the end of an allocated structure. An attacker with a privileged position in the network could leverage this vulnerability to execute code in the context of the current process or cause a denial-of-service condition.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.8.20 or later version",
          "product_ids": [
            "CSAFPID-0002",
            "CSAFPID-0004"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V3.5.5 or later version",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0005",
            "CSAFPID-0006"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006"
          ]
        }
      ],
      "title": "CVE-2020-27009"
    },
    {
      "cve": "CVE-2020-27736",
      "cwe": {
        "id": "CWE-170",
        "name": "Improper Null Termination"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The DNS domain name label parsing functionality does not properly validate the null-terminated name in DNS-responses. The parsing of malformed responses could result in a read past the end of an allocated structure. An attacker with a privileged position in the network could leverage this vulnerability to cause a denial-of-service condition or leak the read memory.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.8.20 or later version",
          "product_ids": [
            "CSAFPID-0002",
            "CSAFPID-0004"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V3.5.5 or later version",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0005",
            "CSAFPID-0006"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006"
          ]
        }
      ],
      "title": "CVE-2020-27736"
    },
    {
      "cve": "CVE-2020-27737",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The DNS response parsing functionality does not properly validate various length and counts of the records. The parsing of malformed responses could result in a read past the end of an allocated structure. An attacker with a privileged position in the network could leverage this vulnerability to cause a denial-of-service condition  or leak the memory past the allocated structure.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.8.20 or later version",
          "product_ids": [
            "CSAFPID-0002",
            "CSAFPID-0004"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V3.5.5 or later version",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0005",
            "CSAFPID-0006"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006"
          ]
        }
      ],
      "title": "CVE-2020-27737"
    },
    {
      "cve": "CVE-2020-27738",
      "cwe": {
        "id": "CWE-788",
        "name": "Access of Memory Location After End of Buffer"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The DNS domain name record decompression functionality does not properly validate the pointer offset values. The parsing of malformed responses could result in a read access past the end of an allocated structure. An attacker with a privileged position in the network could leverage this vulnerability to cause a denial-of-service condition.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.8.20 or later version",
          "product_ids": [
            "CSAFPID-0002",
            "CSAFPID-0004"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V3.5.5 or later version",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0005",
            "CSAFPID-0006"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006"
          ]
        }
      ],
      "title": "CVE-2020-27738"
    },
    {
      "cve": "CVE-2020-28388",
      "cwe": {
        "id": "CWE-342",
        "name": "Predictable Exact Value from Previous Values"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Initial Sequence Numbers (ISNs) for TCP connections are derived from an insufficiently random source. As a result, the ISN of current and future TCP connections could be predictable. An attacker could hijack existing sessions or spoof future ones.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.8.20 or later version",
          "product_ids": [
            "CSAFPID-0002",
            "CSAFPID-0004"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V3.5.5 or later version",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0005",
            "CSAFPID-0006"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006"
          ]
        }
      ],
      "title": "CVE-2020-28388"
    },
    {
      "cve": "CVE-2021-25677",
      "cwe": {
        "id": "CWE-330",
        "name": "Use of Insufficiently Random Values"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The DNS client does not properly randomize DNS transaction IDs. That could allow an attacker to poison the DNS cache or spoof DNS resolving.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.8.20 or later version",
          "product_ids": [
            "CSAFPID-0002",
            "CSAFPID-0004"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V3.5.5 or later version",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0005",
            "CSAFPID-0006"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006"
          ]
        }
      ],
      "title": "CVE-2021-25677"
    },
    {
      "cve": "CVE-2022-45937",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A low privilege authenticated attacker with network access to the integrated web server could download sensitive information from the device containing user account credentials.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.8.20 or later version",
          "product_ids": [
            "CSAFPID-0002",
            "CSAFPID-0004"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V3.5.5 or later version",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0005",
            "CSAFPID-0006"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006"
          ]
        }
      ],
      "title": "CVE-2022-45937"
    }
  ]
}

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "APOGEE PXC / TALON TC field panels (BACnet before V3.5.5 and P2 Ethernet before V2.8.20) contain multiple vulnerabilities:\n\n- CVE-2022-45937: A privilege management vulnerability that could allow low privilege authenticated attackers to gain high privilege access.\n- CVE-2020-28388: Predictable Initial Sequence Numbers in the TCP/IP Stack of Nucleus RTOS (real-time operating system) used by the affected products.\n- Several vulnerabilities in the DNS (domain name service) implementation of Nucleus RTOS.\n\nSiemens has released updates for the affected products and recommends to update to the latest versions.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure Siemens strongly recommends to protect network access to affected products with appropriate mechanisms. It is advised to follow recommended security practices in order to run the devices in a protected IT environment.",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "productcert@siemens.com",
      "name": "Siemens ProductCERT",
      "namespace": "https://www.siemens.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-180579: Privilege Management Vulnerability and Multiple Nucleus RTOS Vulnerabilities in APOGEE/TALON Field Panels before V3.5.5/V2.8.20 - HTML Version",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-180579.html"
      },
      {
        "category": "self",
        "summary": "SSA-180579: Privilege Management Vulnerability and Multiple Nucleus RTOS Vulnerabilities in APOGEE/TALON Field Panels before V3.5.5/V2.8.20 - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-180579.json"
      },
      {
        "category": "self",
        "summary": "SSA-180579: Privilege Management Vulnerability and Multiple Nucleus RTOS Vulnerabilities in APOGEE/TALON Field Panels before V3.5.5/V2.8.20 - PDF Version",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-180579.pdf"
      },
      {
        "category": "self",
        "summary": "SSA-180579: Privilege Management Vulnerability and Multiple Nucleus RTOS Vulnerabilities in APOGEE/TALON Field Panels before V3.5.5/V2.8.20 - TXT Version",
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-180579.txt"
      }
    ],
    "title": "SSA-180579: Privilege Management Vulnerability and Multiple Nucleus RTOS Vulnerabilities in APOGEE/TALON Field Panels before V3.5.5/V2.8.20",
    "tracking": {
      "current_release_date": "2023-08-08T00:00:00Z",
      "generator": {
        "engine": {
          "name": "Siemens ProductCERT CSAF Generator",
          "version": "1"
        }
      },
      "id": "SSA-180579",
      "initial_release_date": "2022-12-13T00:00:00Z",
      "revision_history": [
        {
          "date": "2022-12-13T00:00:00Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        },
        {
          "date": "2023-08-08T00:00:00Z",
          "legacy_version": "1.1",
          "number": "2",
          "summary": "Added additional vulnerabilities that were fixed in the same product versions (V3.5.5 / V2.8.20)"
        }
      ],
      "status": "interim",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/\u003cV3.5.5",
                "product": {
                  "name": "APOGEE PXC Compact (BACnet)",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "APOGEE PXC Compact (BACnet)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/\u003cV2.8.20",
                "product": {
                  "name": "APOGEE PXC Compact (P2 Ethernet)",
                  "product_id": "2"
                }
              }
            ],
            "category": "product_name",
            "name": "APOGEE PXC Compact (P2 Ethernet)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/\u003cV3.5.5",
                "product": {
                  "name": "APOGEE PXC Modular (BACnet)",
                  "product_id": "3"
                }
              }
            ],
            "category": "product_name",
            "name": "APOGEE PXC Modular (BACnet)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/\u003cV2.8.20",
                "product": {
                  "name": "APOGEE PXC Modular (P2 Ethernet)",
                  "product_id": "4"
                }
              }
            ],
            "category": "product_name",
            "name": "APOGEE PXC Modular (P2 Ethernet)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/\u003cV3.5.5",
                "product": {
                  "name": "TALON TC Compact (BACnet)",
                  "product_id": "5"
                }
              }
            ],
            "category": "product_name",
            "name": "TALON TC Compact (BACnet)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/\u003cV3.5.5",
                "product": {
                  "name": "TALON TC Modular (BACnet)",
                  "product_id": "6"
                }
              }
            ],
            "category": "product_name",
            "name": "TALON TC Modular (BACnet)"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-15795",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The DNS domain name label parsing functionality does not properly validate the names in DNS-responses. The parsing of malformed responses could result in a write past the end of an allocated structure. An attacker with a privileged position in the network could leverage this vulnerability to execute code in the context of the current process or cause a denial-of-service condition.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.8.20 or later version",
          "product_ids": [
            "2",
            "4"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V3.5.5 or later version",
          "product_ids": [
            "1",
            "3",
            "5",
            "6"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6"
          ]
        }
      ],
      "title": "CVE-2020-15795"
    },
    {
      "cve": "CVE-2020-27009",
      "cwe": {
        "id": "CWE-823",
        "name": "Use of Out-of-range Pointer Offset"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The DNS domain name record decompression functionality does not properly validate the pointer offset values. The parsing of malformed responses could result in a write past the end of an allocated structure. An attacker with a privileged position in the network could leverage this vulnerability to execute code in the context of the current process or cause a denial-of-service condition.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.8.20 or later version",
          "product_ids": [
            "2",
            "4"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V3.5.5 or later version",
          "product_ids": [
            "1",
            "3",
            "5",
            "6"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6"
          ]
        }
      ],
      "title": "CVE-2020-27009"
    },
    {
      "cve": "CVE-2020-27736",
      "cwe": {
        "id": "CWE-170",
        "name": "Improper Null Termination"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The DNS domain name label parsing functionality does not properly validate the null-terminated name in DNS-responses. The parsing of malformed responses could result in a read past the end of an allocated structure. An attacker with a privileged position in the network could leverage this vulnerability to cause a denial-of-service condition or leak the read memory.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.8.20 or later version",
          "product_ids": [
            "2",
            "4"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V3.5.5 or later version",
          "product_ids": [
            "1",
            "3",
            "5",
            "6"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6"
          ]
        }
      ],
      "title": "CVE-2020-27736"
    },
    {
      "cve": "CVE-2020-27737",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The DNS response parsing functionality does not properly validate various length and counts of the records. The parsing of malformed responses could result in a read past the end of an allocated structure. An attacker with a privileged position in the network could leverage this vulnerability to cause a denial-of-service condition  or leak the memory past the allocated structure.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.8.20 or later version",
          "product_ids": [
            "2",
            "4"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V3.5.5 or later version",
          "product_ids": [
            "1",
            "3",
            "5",
            "6"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6"
          ]
        }
      ],
      "title": "CVE-2020-27737"
    },
    {
      "cve": "CVE-2020-27738",
      "cwe": {
        "id": "CWE-788",
        "name": "Access of Memory Location After End of Buffer"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The DNS domain name record decompression functionality does not properly validate the pointer offset values. The parsing of malformed responses could result in a read access past the end of an allocated structure. An attacker with a privileged position in the network could leverage this vulnerability to cause a denial-of-service condition.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.8.20 or later version",
          "product_ids": [
            "2",
            "4"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V3.5.5 or later version",
          "product_ids": [
            "1",
            "3",
            "5",
            "6"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6"
          ]
        }
      ],
      "title": "CVE-2020-27738"
    },
    {
      "cve": "CVE-2020-28388",
      "cwe": {
        "id": "CWE-342",
        "name": "Predictable Exact Value from Previous Values"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Initial Sequence Numbers (ISNs) for TCP connections are derived from an insufficiently random source. As a result, the ISN of current and future TCP connections could be predictable. An attacker could hijack existing sessions or spoof future ones.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.8.20 or later version",
          "product_ids": [
            "2",
            "4"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V3.5.5 or later version",
          "product_ids": [
            "1",
            "3",
            "5",
            "6"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6"
          ]
        }
      ],
      "title": "CVE-2020-28388"
    },
    {
      "cve": "CVE-2021-25677",
      "cwe": {
        "id": "CWE-330",
        "name": "Use of Insufficiently Random Values"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The DNS client does not properly randomize DNS transaction IDs. That could allow an attacker to poison the DNS cache or spoof DNS resolving.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.8.20 or later version",
          "product_ids": [
            "2",
            "4"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V3.5.5 or later version",
          "product_ids": [
            "1",
            "3",
            "5",
            "6"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6"
          ]
        }
      ],
      "title": "CVE-2021-25677"
    },
    {
      "cve": "CVE-2022-45937",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A low privilege authenticated attacker with network access to the integrated web server could download sensitive information from the device containing user account credentials.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.8.20 or later version",
          "product_ids": [
            "2",
            "4"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V3.5.5 or later version",
          "product_ids": [
            "1",
            "3",
            "5",
            "6"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6"
          ]
        }
      ],
      "title": "CVE-2022-45937"
    }
  ]
}

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited.",
      "tlp": {
        "label": "WHITE"
      }
    },
    "notes": [
      {
        "category": "summary",
        "text": "The networking component (Nucleus NET) in Nucleus Real-Time Operating System (RTOS) use Initial Sequence Numbers for TCP-Sessions that are predictable.\n\nSiemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not available.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: \nhttps://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: \nhttps://www.siemens.com/industrialsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "productcert@siemens.com",
      "name": "Siemens ProductCERT",
      "namespace": "https://www.siemens.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-362164: Predictable Initial Sequence Numbers in the TCP/IP Stack of Nucleus RTOS - PDF Version",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-362164.pdf"
      },
      {
        "category": "self",
        "summary": "SSA-362164: Predictable Initial Sequence Numbers in the TCP/IP Stack of Nucleus RTOS - TXT Version",
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-362164.txt"
      },
      {
        "category": "self",
        "summary": "SSA-362164: Predictable Initial Sequence Numbers in the TCP/IP Stack of Nucleus RTOS - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-362164.json"
      }
    ],
    "title": "SSA-362164: Predictable Initial Sequence Numbers in the TCP/IP Stack of Nucleus RTOS",
    "tracking": {
      "current_release_date": "2022-11-08T00:00:00Z",
      "generator": {
        "engine": {
          "name": "Siemens ProductCERT CSAF Generator",
          "version": "1"
        }
      },
      "id": "SSA-362164",
      "initial_release_date": "2021-02-09T00:00:00Z",
      "revision_history": [
        {
          "date": "2021-02-09T00:00:00Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        },
        {
          "date": "2021-11-09T00:00:00Z",
          "legacy_version": "1.1",
          "number": "2",
          "summary": "Consolidated list of products"
        },
        {
          "date": "2022-11-08T00:00:00Z",
          "legacy_version": "1.2",
          "number": "3",
          "summary": "Removed Capital VSTAR as it is not affected by CVE-2022-28388"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c V5.2",
                "product": {
                  "name": "Nucleus NET",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "Nucleus NET"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c V2012.12",
                "product": {
                  "name": "Nucleus ReadyStart V3",
                  "product_id": "2"
                }
              }
            ],
            "category": "product_name",
            "name": "Nucleus ReadyStart V3"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Nucleus Source Code",
                  "product_id": "3"
                }
              }
            ],
            "category": "product_name",
            "name": "Nucleus Source Code"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-28388",
      "cwe": {
        "id": "CWE-342",
        "name": "Predictable Exact Value from Previous Values"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Initial Sequence Numbers (ISNs) for TCP connections are derived from an insufficiently random source. As a result, the ISN of current and future TCP connections could be predictable. An attacker could hijack existing sessions or spoof future ones.\n",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "Protect transmitted data with cryptographic protocols such as Transport Layer Security",
          "product_ids": [
            "1",
            "2",
            "3"
          ]
        },
        {
          "category": "mitigation",
          "details": "Contact customer support or your local Nucleus Sales team for mitigation advice",
          "product_ids": [
            "1"
          ]
        },
        {
          "category": "mitigation",
          "details": "Note that the latest version of Nucleus NET (V5.2) is not affected, but is already beyond end of software support",
          "product_ids": [
            "1"
          ]
        },
        {
          "category": "mitigation",
          "details": "Update to the latest version of Nucleus ReadyStart V3 or V4",
          "product_ids": [
            "1"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "Currently no fix is planned",
          "product_ids": [
            "1"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V2012.12 or later version",
          "product_ids": [
            "2"
          ],
          "url": "https://support.sw.siemens.com/en-US/product/1009925838/"
        },
        {
          "category": "vendor_fix",
          "details": "Contact customer support to receive patch and update information",
          "product_ids": [
            "3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3"
          ]
        }
      ],
      "title": "CVE-2020-28388"
    }
  ]
}

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
      "tlp": {
        "label": "WHITE"
      }
    },
    "notes": [
      {
        "category": "summary",
        "text": "A TCP sequence vulnerability in the APOGEE PXC and TALON TC series of products could allow an attacker to execute a denial of service attack by sending specially crafted packets to the device.\n\nSiemens has released updates for the affected products and recommends to update to the latest versions.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure Siemens strongly recommends to protect network access to affected products with appropriate mechanisms. It is advised to follow recommended security practices in order to run the devices in a protected IT environment.",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "productcert@siemens.com",
      "name": "Siemens ProductCERT",
      "namespace": "https://www.siemens.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-436469: TCP Vulnerability in APOGEE/TALON Field Panels - PDF Version",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-436469.pdf"
      },
      {
        "category": "self",
        "summary": "SSA-436469: TCP Vulnerability in APOGEE/TALON Field Panels - TXT Version",
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-436469.txt"
      },
      {
        "category": "self",
        "summary": "SSA-436469: TCP Vulnerability in APOGEE/TALON Field Panels - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-436469.json"
      }
    ],
    "title": "SSA-436469: TCP Vulnerability in APOGEE/TALON Field Panels",
    "tracking": {
      "current_release_date": "2022-12-13T00:00:00Z",
      "generator": {
        "engine": {
          "name": "Siemens ProductCERT CSAF Generator",
          "version": "1"
        }
      },
      "id": "SSA-436469",
      "initial_release_date": "2022-12-13T00:00:00Z",
      "revision_history": [
        {
          "date": "2022-12-13T00:00:00Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c V3.5.5",
                "product": {
                  "name": "APOGEE PXC Series (BACnet)",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "APOGEE PXC Series (BACnet)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c V2.8.20",
                "product": {
                  "name": "APOGEE PXC Series (P2 Ethernet)",
                  "product_id": "2"
                }
              }
            ],
            "category": "product_name",
            "name": "APOGEE PXC Series (P2 Ethernet)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c V3.5.5",
                "product": {
                  "name": "TALON TC Series (BACnet)",
                  "product_id": "3"
                }
              }
            ],
            "category": "product_name",
            "name": "TALON TC Series (BACnet)"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-28388",
      "cwe": {
        "id": "CWE-342",
        "name": "Predictable Exact Value from Previous Values"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Initial Sequence Numbers (ISNs) for TCP connections are derived from an insufficiently random source. As a result, the ISN of current and future TCP connections could be predictable. An attacker could hijack existing sessions or spoof future ones.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V3.5.5 or later version",
          "product_ids": [
            "1",
            "3"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V2.8.20 or later version",
          "product_ids": [
            "2"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3"
          ]
        }
      ],
      "title": "CVE-2020-28388"
    }
  ]
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202102-1448",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "nucleus net",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "5.2"
      },
      {
        "model": "nucleus source code",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "*"
      },
      {
        "model": "nucleus readystart",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "2012.12"
      },
      {
        "model": "capital vstar",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "*"
      },
      {
        "model": "pluscontrol 1st gen",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "*"
      },
      {
        "model": "nucleus readystart",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30b7\u30fc\u30e1\u30f3\u30b9",
        "version": null
      },
      {
        "model": "nucleus net",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30b7\u30fc\u30e1\u30f3\u30b9",
        "version": null
      },
      {
        "model": "nucleus net",
        "scope": "lt",
        "trust": 0.6,
        "vendor": "siemens",
        "version": "v5.2"
      },
      {
        "model": "nucleus readystart for arm,mips,and ppc",
        "scope": "lt",
        "trust": 0.6,
        "vendor": "siemens",
        "version": "v2012.12"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2021-11834"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-015980"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-28388"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "and Amine Amri of Forescout Research Labs reported these vulnerabilities to CISA., Stanislav Dashevskyi,Daniel dos Santos, Jos Wetzels",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202102-881"
      }
    ],
    "trust": 0.6
  },
  "cve": "CVE-2020-28388",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "id": "CVE-2020-28388",
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 1.9,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "CNVD",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "id": "CNVD-2021-11834",
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 0.6,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 3.9,
            "id": "CVE-2020-28388",
            "impactScore": 1.4,
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "productcert@siemens.com",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 3.9,
            "id": "CVE-2020-28388",
            "impactScore": 2.5,
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 5.3,
            "baseSeverity": "Medium",
            "confidentialityImpact": "None",
            "exploitabilityScore": null,
            "id": "CVE-2020-28388",
            "impactScore": null,
            "integrityImpact": "Low",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2020-28388",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "productcert@siemens.com",
            "id": "CVE-2020-28388",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "NVD",
            "id": "CVE-2020-28388",
            "trust": 0.8,
            "value": "Medium"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2021-11834",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202102-881",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "VULMON",
            "id": "CVE-2020-28388",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2021-11834"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-28388"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-015980"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202102-881"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-28388"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-28388"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions \u003c V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions \u003c V2.8.20), APOGEE PXC Modular (BACnet) (All versions \u003c V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions \u003c V2.8.20), Nucleus NET (All versions \u003c V5.2), Nucleus ReadyStart V3 (All versions \u003c V2012.12), Nucleus Source Code (All versions), PLUSCONTROL 1st Gen (All versions), TALON TC Compact (BACnet) (All versions \u003c V3.5.5), TALON TC Modular (BACnet) (All versions \u003c V3.5.5). Initial Sequence Numbers (ISNs) for TCP connections are derived from an insufficiently random source. As a result, the ISN of current and future TCP connections could be predictable. An attacker could hijack existing sessions or spoof future ones. Nucleus NET , Nucleus ReadyStart , PLUSCONTROL 1st Gen Exists in unspecified vulnerabilities.Information may be tampered with. The Nucleus NET module contains a series of standard-compliant network and communication protocols, drivers and utilities to provide full-featured network support in any embedded device. \n\r\n\r\nSiemens Nucleus NET has security vulnerabilities",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2020-28388"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-015980"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2021-11834"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-28388"
      }
    ],
    "trust": 2.25
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2020-28388",
        "trust": 3.9
      },
      {
        "db": "SIEMENS",
        "id": "SSA-362164",
        "trust": 2.3
      },
      {
        "db": "SIEMENS",
        "id": "SSA-436469",
        "trust": 1.7
      },
      {
        "db": "SIEMENS",
        "id": "SSA-344238",
        "trust": 1.7
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-21-068-08",
        "trust": 1.4
      },
      {
        "db": "SIEMENS",
        "id": "SSA-180579",
        "trust": 1.0
      },
      {
        "db": "JVN",
        "id": "JVNVU91083521",
        "trust": 0.8
      },
      {
        "db": "JVN",
        "id": "JVNVU90767599",
        "trust": 0.8
      },
      {
        "db": "JVN",
        "id": "JVNVU91561630",
        "trust": 0.8
      },
      {
        "db": "JVN",
        "id": "JVNVU93441670",
        "trust": 0.8
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-22-349-14",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-015980",
        "trust": 0.8
      },
      {
        "db": "CNVD",
        "id": "CNVD-2021-11834",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2021.0853",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2021.0538",
        "trust": 0.6
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-21-042-01",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202102-881",
        "trust": 0.6
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-22-349-10",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-28388",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2021-11834"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-28388"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-015980"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202102-881"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-28388"
      }
    ]
  },
  "id": "VAR-202102-1448",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2021-11834"
      }
    ],
    "trust": 0.9393398399999999
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "ICS"
        ],
        "sub_category": null,
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2021-11834"
      }
    ]
  },
  "last_update_date": "2024-11-23T20:57:34.216000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "SSA-362164 Siemens\u00a0Security\u00a0Advisory",
        "trust": 0.8,
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-362164.pdf"
      },
      {
        "title": "Patch for Siemens Nucleus NET predictable initial sequence vulnerability",
        "trust": 0.6,
        "url": "https://www.cnvd.org.cn/patchInfo/show/248776"
      },
      {
        "title": "Multiple  Nucleus product Security vulnerabilities",
        "trust": 0.6,
        "url": "http://123.124.177.30/web/xxk/bdxqById.tag?id=141302"
      },
      {
        "title": "Siemens Security Advisories: Siemens Security Advisory",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=siemens_security_advisories\u0026qid=864fdb86041bc2144f114e7ec91e8aa5"
      },
      {
        "title": "Siemens Security Advisories: Siemens Security Advisory",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=siemens_security_advisories\u0026qid=ec5d325ed2cb9493722dc92d15dd7d3b"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2021-11834"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-28388"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-015980"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202102-881"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "NVD-CWE-Other",
        "trust": 1.0
      },
      {
        "problemtype": "CWE-342",
        "trust": 1.0
      },
      {
        "problemtype": "others (CWE-Other) [NVD evaluation ]",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-015980"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-28388"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.3,
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-362164.pdf"
      },
      {
        "trust": 1.7,
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-344238.pdf"
      },
      {
        "trust": 1.7,
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-436469.pdf"
      },
      {
        "trust": 1.0,
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-180579.pdf"
      },
      {
        "trust": 0.8,
        "url": "http://jvn.jp/vu/jvnvu91083521"
      },
      {
        "trust": 0.8,
        "url": "http://jvn.jp/vu/jvnvu93441670"
      },
      {
        "trust": 0.8,
        "url": "https://jvn.jp/vu/jvnvu90767599"
      },
      {
        "trust": 0.8,
        "url": "https://jvn.jp/vu/jvnvu91561630/"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-28388"
      },
      {
        "trust": 0.8,
        "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-349-14"
      },
      {
        "trust": 0.8,
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-068-08"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2021.0853"
      },
      {
        "trust": 0.6,
        "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-068-08"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2021.0538"
      },
      {
        "trust": 0.6,
        "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-042-01"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/342.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-349-10"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2021-11834"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-28388"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-015980"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202102-881"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-28388"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "CNVD",
        "id": "CNVD-2021-11834"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-28388"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-015980"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202102-881"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-28388"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2021-02-22T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2021-11834"
      },
      {
        "date": "2021-02-09T00:00:00",
        "db": "VULMON",
        "id": "CVE-2020-28388"
      },
      {
        "date": "2021-10-29T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2020-015980"
      },
      {
        "date": "2021-02-09T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202102-881"
      },
      {
        "date": "2021-02-09T18:15:34.590000",
        "db": "NVD",
        "id": "CVE-2020-28388"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2021-04-12T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2021-11834"
      },
      {
        "date": "2022-12-13T00:00:00",
        "db": "VULMON",
        "id": "CVE-2020-28388"
      },
      {
        "date": "2024-09-12T07:14:00",
        "db": "JVNDB",
        "id": "JVNDB-2020-015980"
      },
      {
        "date": "2022-12-14T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202102-881"
      },
      {
        "date": "2024-11-21T05:22:42.130000",
        "db": "NVD",
        "id": "CVE-2020-28388"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202102-881"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Vulnerabilities in multiple Siemens products",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-015980"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "other",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202102-881"
      }
    ],
    "trust": 0.6
  }
}

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Der TCP/IP-Stack bzw. die Internet Protocol Suite ist eine Reihe von Kommunikationsprotokollen, die vom Internet oder \u00e4hnlichen Netzwerken verwendet werden.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in TCP/IP Stack ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Denial-of-Service-Zustand herbeif\u00fchren oder Sicherheitsvorkehrungen umgehen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2023-1987 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2021/wid-sec-w-2023-1987.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2023-1987 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-1987"
      },
      {
        "category": "external",
        "summary": "Siemens Security Advisory SSA-180579 vom 2023-08-08",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-180579.html"
      },
      {
        "category": "external",
        "summary": "US-CERT-Report vom 2021-02-11",
        "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-042-01"
      },
      {
        "category": "external",
        "summary": "Siemens Security Advisory by Siemens ProductCERT",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-362164.pdf"
      }
    ],
    "source_lang": "en-US",
    "title": "TCP/IP Stack: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2023-08-07T22:00:00.000+00:00",
      "generator": {
        "date": "2024-08-15T17:56:41.058+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.5"
        }
      },
      "id": "WID-SEC-W-2023-1987",
      "initial_release_date": "2021-02-11T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2021-02-11T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2021-11-08T23:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Siemens aufgenommen"
        },
        {
          "date": "2023-08-07T22:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von Siemens aufgenommen"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Open Source TCP/IP Stack",
            "product": {
              "name": "Open Source TCP/IP Stack",
              "product_id": "T017866",
              "product_identification_helper": {
                "cpe": "cpe:/a:open_source:tcpip_stack:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Siemens Nucleus RTOS",
            "product": {
              "name": "Siemens Nucleus RTOS",
              "product_id": "683163",
              "product_identification_helper": {
                "cpe": "cpe:/o:siemens:nucleus_rtos:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-27213",
      "notes": [
        {
          "category": "description",
          "text": "In TCP/IP Stack existieren mehrere Schwachstellen, die IoT-Ger\u00e4te betreffen. Der Grund f\u00fcr diese Schwachstellen, welche unter dem Namen \"NUMBER:JACK\" ver\u00f6ffentlicht wurden ist, dass Fehler bei der Implementierung des ISN(Initial Sequence Number) besteht. Die ISN wird beim Aufbau einer Session erzeugt und im Fall der betroffenen TCP/IP-Stack Implementierungen wurden schwache PRNG\u0027s verwendet oder von dem entsprechenden RFC abgewichen. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Denial of Service Zustand herbeizuf\u00fchren oder Sicherheitsvorkehrungen zu umgehen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T017866",
          "683163"
        ]
      },
      "release_date": "2021-02-11T23:00:00.000+00:00",
      "title": "CVE-2020-27213"
    },
    {
      "cve": "CVE-2020-27630",
      "notes": [
        {
          "category": "description",
          "text": "In TCP/IP Stack existieren mehrere Schwachstellen, die IoT-Ger\u00e4te betreffen. Der Grund f\u00fcr diese Schwachstellen, welche unter dem Namen \"NUMBER:JACK\" ver\u00f6ffentlicht wurden ist, dass Fehler bei der Implementierung des ISN(Initial Sequence Number) besteht. Die ISN wird beim Aufbau einer Session erzeugt und im Fall der betroffenen TCP/IP-Stack Implementierungen wurden schwache PRNG\u0027s verwendet oder von dem entsprechenden RFC abgewichen. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Denial of Service Zustand herbeizuf\u00fchren oder Sicherheitsvorkehrungen zu umgehen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T017866",
          "683163"
        ]
      },
      "release_date": "2021-02-11T23:00:00.000+00:00",
      "title": "CVE-2020-27630"
    },
    {
      "cve": "CVE-2020-27631",
      "notes": [
        {
          "category": "description",
          "text": "In TCP/IP Stack existieren mehrere Schwachstellen, die IoT-Ger\u00e4te betreffen. Der Grund f\u00fcr diese Schwachstellen, welche unter dem Namen \"NUMBER:JACK\" ver\u00f6ffentlicht wurden ist, dass Fehler bei der Implementierung des ISN(Initial Sequence Number) besteht. Die ISN wird beim Aufbau einer Session erzeugt und im Fall der betroffenen TCP/IP-Stack Implementierungen wurden schwache PRNG\u0027s verwendet oder von dem entsprechenden RFC abgewichen. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Denial of Service Zustand herbeizuf\u00fchren oder Sicherheitsvorkehrungen zu umgehen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T017866",
          "683163"
        ]
      },
      "release_date": "2021-02-11T23:00:00.000+00:00",
      "title": "CVE-2020-27631"
    },
    {
      "cve": "CVE-2020-27632",
      "notes": [
        {
          "category": "description",
          "text": "In TCP/IP Stack existieren mehrere Schwachstellen, die IoT-Ger\u00e4te betreffen. Der Grund f\u00fcr diese Schwachstellen, welche unter dem Namen \"NUMBER:JACK\" ver\u00f6ffentlicht wurden ist, dass Fehler bei der Implementierung des ISN(Initial Sequence Number) besteht. Die ISN wird beim Aufbau einer Session erzeugt und im Fall der betroffenen TCP/IP-Stack Implementierungen wurden schwache PRNG\u0027s verwendet oder von dem entsprechenden RFC abgewichen. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Denial of Service Zustand herbeizuf\u00fchren oder Sicherheitsvorkehrungen zu umgehen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T017866",
          "683163"
        ]
      },
      "release_date": "2021-02-11T23:00:00.000+00:00",
      "title": "CVE-2020-27632"
    },
    {
      "cve": "CVE-2020-27633",
      "notes": [
        {
          "category": "description",
          "text": "In TCP/IP Stack existieren mehrere Schwachstellen, die IoT-Ger\u00e4te betreffen. Der Grund f\u00fcr diese Schwachstellen, welche unter dem Namen \"NUMBER:JACK\" ver\u00f6ffentlicht wurden ist, dass Fehler bei der Implementierung des ISN(Initial Sequence Number) besteht. Die ISN wird beim Aufbau einer Session erzeugt und im Fall der betroffenen TCP/IP-Stack Implementierungen wurden schwache PRNG\u0027s verwendet oder von dem entsprechenden RFC abgewichen. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Denial of Service Zustand herbeizuf\u00fchren oder Sicherheitsvorkehrungen zu umgehen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T017866",
          "683163"
        ]
      },
      "release_date": "2021-02-11T23:00:00.000+00:00",
      "title": "CVE-2020-27633"
    },
    {
      "cve": "CVE-2020-27634",
      "notes": [
        {
          "category": "description",
          "text": "In TCP/IP Stack existieren mehrere Schwachstellen, die IoT-Ger\u00e4te betreffen. Der Grund f\u00fcr diese Schwachstellen, welche unter dem Namen \"NUMBER:JACK\" ver\u00f6ffentlicht wurden ist, dass Fehler bei der Implementierung des ISN(Initial Sequence Number) besteht. Die ISN wird beim Aufbau einer Session erzeugt und im Fall der betroffenen TCP/IP-Stack Implementierungen wurden schwache PRNG\u0027s verwendet oder von dem entsprechenden RFC abgewichen. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Denial of Service Zustand herbeizuf\u00fchren oder Sicherheitsvorkehrungen zu umgehen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T017866",
          "683163"
        ]
      },
      "release_date": "2021-02-11T23:00:00.000+00:00",
      "title": "CVE-2020-27634"
    },
    {
      "cve": "CVE-2020-27635",
      "notes": [
        {
          "category": "description",
          "text": "In TCP/IP Stack existieren mehrere Schwachstellen, die IoT-Ger\u00e4te betreffen. Der Grund f\u00fcr diese Schwachstellen, welche unter dem Namen \"NUMBER:JACK\" ver\u00f6ffentlicht wurden ist, dass Fehler bei der Implementierung des ISN(Initial Sequence Number) besteht. Die ISN wird beim Aufbau einer Session erzeugt und im Fall der betroffenen TCP/IP-Stack Implementierungen wurden schwache PRNG\u0027s verwendet oder von dem entsprechenden RFC abgewichen. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Denial of Service Zustand herbeizuf\u00fchren oder Sicherheitsvorkehrungen zu umgehen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T017866",
          "683163"
        ]
      },
      "release_date": "2021-02-11T23:00:00.000+00:00",
      "title": "CVE-2020-27635"
    },
    {
      "cve": "CVE-2020-27636",
      "notes": [
        {
          "category": "description",
          "text": "In TCP/IP Stack existieren mehrere Schwachstellen, die IoT-Ger\u00e4te betreffen. Der Grund f\u00fcr diese Schwachstellen, welche unter dem Namen \"NUMBER:JACK\" ver\u00f6ffentlicht wurden ist, dass Fehler bei der Implementierung des ISN(Initial Sequence Number) besteht. Die ISN wird beim Aufbau einer Session erzeugt und im Fall der betroffenen TCP/IP-Stack Implementierungen wurden schwache PRNG\u0027s verwendet oder von dem entsprechenden RFC abgewichen. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Denial of Service Zustand herbeizuf\u00fchren oder Sicherheitsvorkehrungen zu umgehen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T017866",
          "683163"
        ]
      },
      "release_date": "2021-02-11T23:00:00.000+00:00",
      "title": "CVE-2020-27636"
    },
    {
      "cve": "CVE-2020-28388",
      "notes": [
        {
          "category": "description",
          "text": "In TCP/IP Stack existieren mehrere Schwachstellen, die IoT-Ger\u00e4te betreffen. Der Grund f\u00fcr diese Schwachstellen, welche unter dem Namen \"NUMBER:JACK\" ver\u00f6ffentlicht wurden ist, dass Fehler bei der Implementierung des ISN(Initial Sequence Number) besteht. Die ISN wird beim Aufbau einer Session erzeugt und im Fall der betroffenen TCP/IP-Stack Implementierungen wurden schwache PRNG\u0027s verwendet oder von dem entsprechenden RFC abgewichen. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um beliebigen Programmcode auszuf\u00fchren, einen Denial of Service Zustand herbeizuf\u00fchren oder Sicherheitsvorkehrungen zu umgehen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T017866",
          "683163"
        ]
      },
      "release_date": "2021-02-11T23:00:00.000+00:00",
      "title": "CVE-2020-28388"
    }
  ]
}