First published: Tue Oct 10 2023(Updated: )
In PicoTCP 1.7.0, TCP ISNs are improperly random.
Credit: cve@mitre.org cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
PicoTCP | =1.7.0 | |
Multiple Nut/Net, Version 5.1 and prior | ||
Multiple CycloneTCP, Version 1.9.6 and prior | ||
Multiple NDKTCPIP, Version 2.25 and prior | ||
butok FNET | ||
Contiki OS | ||
Multiple uC/TCP-IP (EOL), Version 3.6.0 and prior | ||
Contiki-NG | ||
Multiple uIP (EOL), Version 1.0 and prior | ||
altran picoTCP-NG | ||
Multiple picoTCP (EOL), Version 1.7.0 and prior | ||
Multiple MPLAB Net, Version 3.6.1 and prior | ||
Multiple Nucleus NET, All versions prior to Version 5.2 | ||
Multiple Nucleus ReadyStart for ARM, MIPS, and PPC, All versions prior to Version 2012.12 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2020-27635 has a medium severity rating due to its impact on TCP session integrity.
To mitigate CVE-2020-27635, update the affected software to the latest versions that resolve the improper TCP ISN generation.
CVE-2020-27635 affects multiple software products, including PicoTCP 1.7.0 and prior, as well as various versions of Nut/Net, CycloneTCP, and NDKTCPIP.
Exploiting CVE-2020-27635 could allow an attacker to hijack TCP connections, intercepting or injecting data into the traffic.
Yes, CVE-2020-27635 is particularly relevant for embedded systems using affected TCP/IP stacks, which may be less monitored.