CVE-2020-28388: Medium severity Siemens Capital Vstar vulnerability

Q: What is the severity of CVE-2020-28388?

The severity of CVE-2020-28388 is medium with a score of 5.3.

Q: Which software versions are affected by CVE-2020-28388?

The affected software versions of CVE-2020-28388 include APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (All versions < V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.20), Nucleus NET (All versions < V5.2), and Nucleus Source Code.

Q: How can I fix CVE-2020-28388?

To fix CVE-2020-28388, you should update your software to version V3.5.5 or later for APOGEE PXC Compact (BACnet), version V2.8.20 or later for APOGEE PXC Compact (P2 Ethernet), version V3.5.5 or later for APOGEE PXC Modular (BACnet), version V2.8.20 or later for APOGEE PXC Modular (P2 Ethernet), and version V5.2 or later for Nucleus NET.

Q: Where can I find more information about CVE-2020-28388?

You can find more information about CVE-2020-28388 in the following references: - [SSA-180579](https://cert-portal.siemens.com/productcert/pdf/ssa-180579.pdf) - [SSA-344238](https://cert-portal.siemens.com/productcert/pdf/ssa-344238.pdf) - [SSA-362164](https://cert-portal.siemens.com/productcert/pdf/ssa-362164.pdf)

Q: What is the Common Weakness Enumeration (CWE) ID of CVE-2020-28388?

The Common Weakness Enumeration (CWE) ID of CVE-2020-28388 is 342.

Published Feb 9, 2021

Updated

A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (All versions < V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.20), Nucleus NET (All versions < V5.2), Nucleus ReadyStart V3 (All versions < V2012.12), Nucleus Source Code (All versions), PLUSCONTROL 1st Gen (All versions), TALON TC Compact (BACnet) (All versions < V3.5.5), TALON TC Modular (BACnet) (All versions < V3.5.5). Initial Sequence Numbers (ISNs) for TCP connections are derived from an insufficiently random source. As a result, the ISN of current and future TCP connections could be predictable. An attacker could hijack existing sessions or spoof future ones.

Affected Software

21 affected components

Siemens Capital Vstar

Siemens Nucleus NET<5.2

Siemens Nucleus Source Code

Siemens Pluscontrol 1st Gen

Siemens Nucleus Readystart<2012.12

Arm Arm

Mips Mips

Powerpc Project Powerpc

Multiple Nut/Net, Version 5.1 and prior

Multiple CycloneTCP, Version 1.9.6 and prior

Multiple NDKTCPIP, Version 2.25 and prior

Multiple FNET, Version 4.6.3

Multiple uIP-Contiki-OS (end-of-life [EOL]), Version 3.0 and prior

Multiple uC/TCP-IP (EOL), Version 3.6.0 and prior

Multiple uIP-Contiki-NG, Version 4.5 and prior

Multiple uIP (EOL), Version 1.0 and prior

Multiple picoTCP-NG, Version 1.7.0 and prior

Multiple picoTCP (EOL), Version 1.7.0 and prior

Multiple MPLAB Net, Version 3.6.1 and prior

Multiple Nucleus NET, All versions prior to Version 5.2

Multiple Nucleus ReadyStart for ARM, MIPS, and PPC, All versions prior to Version 2012.12

Event History

Feb 9, 2021

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

ICSA-21-042-01

Frequently Asked Questions

What is the severity of CVE-2020-28388?

The severity of CVE-2020-28388 is medium with a score of 5.3.

Which software versions are affected by CVE-2020-28388?

The affected software versions of CVE-2020-28388 include APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (All versions < V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.20), Nucleus NET (All versions < V5.2), and Nucleus Source Code.

How can I fix CVE-2020-28388?

To fix CVE-2020-28388, you should update your software to version V3.5.5 or later for APOGEE PXC Compact (BACnet), version V2.8.20 or later for APOGEE PXC Compact (P2 Ethernet), version V3.5.5 or later for APOGEE PXC Modular (BACnet), version V2.8.20 or later for APOGEE PXC Modular (P2 Ethernet), and version V5.2 or later for Nucleus NET.

Where can I find more information about CVE-2020-28388?