medium
6.5
CWE
342 330
Advisory Published
Updated

CVE-2020-28388

First published: Tue Feb 09 2021(Updated: )

A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (All versions < V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.20), Nucleus NET (All versions < V5.2), Nucleus ReadyStart V3 (All versions < V2012.12), Nucleus Source Code (All versions), PLUSCONTROL 1st Gen (All versions), TALON TC Compact (BACnet) (All versions < V3.5.5), TALON TC Modular (BACnet) (All versions < V3.5.5). Initial Sequence Numbers (ISNs) for TCP connections are derived from an insufficiently random source. As a result, the ISN of current and future TCP connections could be predictable. An attacker could hijack existing sessions or spoof future ones.

Credit: productcert@siemens.com productcert@siemens.com

Affected SoftwareAffected VersionHow to fix
Siemens Capital VSTAR
Siemens Nucleus NET<5.2
Siemens Nucleus Source Code
siemens PLUSCONTROL 1st Gen
Siemens Nucleus ReadyStart<2012.12
Arm
mips
PowerPC Project
Multiple Nut/Net, Version 5.1 and prior
Multiple CycloneTCP, Version 1.9.6 and prior
Multiple NDKTCPIP, Version 2.25 and prior
butok FNET
Contiki OS
Multiple uC/TCP-IP (EOL), Version 3.6.0 and prior
Contiki-NG
Multiple uIP (EOL), Version 1.0 and prior
altran picoTCP-NG
Multiple picoTCP (EOL), Version 1.7.0 and prior
Multiple MPLAB Net, Version 3.6.1 and prior
Multiple Nucleus NET, All versions prior to Version 5.2
Multiple Nucleus ReadyStart for ARM, MIPS, and PPC, All versions prior to Version 2012.12

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Parent vulnerabilities

(Appears in the following advisories)

Frequently Asked Questions

  • What is the severity of CVE-2020-28388?

    The severity of CVE-2020-28388 is medium with a score of 5.3.

  • Which software versions are affected by CVE-2020-28388?

    The affected software versions of CVE-2020-28388 include APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (All versions < V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.20), Nucleus NET (All versions < V5.2), and Nucleus Source Code.

  • How can I fix CVE-2020-28388?

    To fix CVE-2020-28388, you should update your software to version V3.5.5 or later for APOGEE PXC Compact (BACnet), version V2.8.20 or later for APOGEE PXC Compact (P2 Ethernet), version V3.5.5 or later for APOGEE PXC Modular (BACnet), version V2.8.20 or later for APOGEE PXC Modular (P2 Ethernet), and version V5.2 or later for Nucleus NET.

  • Where can I find more information about CVE-2020-28388?

    You can find more information about CVE-2020-28388 in the following references: - [SSA-180579](https://cert-portal.siemens.com/productcert/pdf/ssa-180579.pdf) - [SSA-344238](https://cert-portal.siemens.com/productcert/pdf/ssa-344238.pdf) - [SSA-362164](https://cert-portal.siemens.com/productcert/pdf/ssa-362164.pdf)

  • What is the Common Weakness Enumeration (CWE) ID of CVE-2020-28388?

    The Common Weakness Enumeration (CWE) ID of CVE-2020-28388 is 342.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203