CVE-2020-28388
First published: Tue Feb 09 2021(Updated: )
A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (All versions < V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.20), Nucleus NET (All versions < V5.2), Nucleus ReadyStart V3 (All versions < V2012.12), Nucleus Source Code (All versions), PLUSCONTROL 1st Gen (All versions), TALON TC Compact (BACnet) (All versions < V3.5.5), TALON TC Modular (BACnet) (All versions < V3.5.5). Initial Sequence Numbers (ISNs) for TCP connections are derived from an insufficiently random source. As a result, the ISN of current and future TCP connections could be predictable. An attacker could hijack existing sessions or spoof future ones.
Credit: productcert@siemens.com productcert@siemens.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Multiple Nut/Net, Version 5.1 and prior | ||
| Multiple CycloneTCP, Version 1.9.6 and prior | ||
| Multiple NDKTCPIP, Version 2.25 and prior | ||
| Multiple FNET, Version 4.6.3 | ||
| Multiple uIP-Contiki-OS (end-of-life [EOL]), Version 3.0 and prior | ||
| Multiple uC/TCP-IP (EOL), Version 3.6.0 and prior | ||
| Multiple uIP-Contiki-NG, Version 4.5 and prior | ||
| Multiple uIP (EOL), Version 1.0 and prior | ||
| Multiple picoTCP-NG, Version 1.7.0 and prior | ||
| Multiple picoTCP (EOL), Version 1.7.0 and prior | ||
| Multiple MPLAB Net, Version 3.6.1 and prior | ||
| Multiple Nucleus NET, All versions prior to Version 5.2 | ||
| Multiple Nucleus ReadyStart for ARM, MIPS, and PPC, All versions prior to Version 2012.12 | ||
| Siemens Capital Vstar | ||
| Siemens Nucleus NET | <5.2 | |
| Siemens Nucleus Source Code | ||
| Siemens Pluscontrol 1st Gen | ||
| Siemens Nucleus Readystart | <2012.12 | |
| Arm Arm | ||
| Mips Mips | ||
| Powerpc Project Powerpc |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://cert-portal.siemens.com/productcert/pdf/ssa-180579.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-344238.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-362164.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-436469.pdf
- https://www.cisa.gov/news-events/ics-advisories/icsa-21-042-01 (Advisory)
Frequently Asked Questions
What is the severity of CVE-2020-28388?
The severity of CVE-2020-28388 is medium with a score of 5.3.
Which software versions are affected by CVE-2020-28388?
The affected software versions of CVE-2020-28388 include APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (All versions < V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.20), Nucleus NET (All versions < V5.2), and Nucleus Source Code.
How can I fix CVE-2020-28388?
To fix CVE-2020-28388, you should update your software to version V3.5.5 or later for APOGEE PXC Compact (BACnet), version V2.8.20 or later for APOGEE PXC Compact (P2 Ethernet), version V3.5.5 or later for APOGEE PXC Modular (BACnet), version V2.8.20 or later for APOGEE PXC Modular (P2 Ethernet), and version V5.2 or later for Nucleus NET.
Where can I find more information about CVE-2020-28388?
You can find more information about CVE-2020-28388 in the following references: - [SSA-180579](https://cert-portal.siemens.com/productcert/pdf/ssa-180579.pdf) - [SSA-344238](https://cert-portal.siemens.com/productcert/pdf/ssa-344238.pdf) - [SSA-362164](https://cert-portal.siemens.com/productcert/pdf/ssa-362164.pdf)
What is the Common Weakness Enumeration (CWE) ID of CVE-2020-28388?
The Common Weakness Enumeration (CWE) ID of CVE-2020-28388 is 342.
- agent/author
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- agent/severity
- agent/weakness
- agent/references
- agent/description
- collector/ics-cert-advisory
- source/ICS
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/tags
- agent/event
- collector/nvd-api
- collector/nvd-index
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- vendor/multiple
- canonical/multiple nut/net, version 5.1 and prior
- canonical/multiple cyclonetcp, version 1.9.6 and prior
- canonical/multiple ndktcpip, version 2.25 and prior
- canonical/multiple fnet, version 4.6.3
- canonical/multiple uip-contiki-os (end-of-life [eol]), version 3.0 and prior
- canonical/multiple uc/tcp-ip (eol), version 3.6.0 and prior
- canonical/multiple uip-contiki-ng, version 4.5 and prior
- canonical/multiple uip (eol), version 1.0 and prior
- canonical/multiple picotcp-ng, version 1.7.0 and prior
- canonical/multiple picotcp (eol), version 1.7.0 and prior
- canonical/multiple mplab net, version 3.6.1 and prior
- canonical/multiple nucleus net, all versions prior to version 5.2
- canonical/multiple nucleus readystart for arm, mips, and ppc, all versions prior to version 2012.12
- vendor/siemens
- canonical/siemens capital vstar
- canonical/siemens nucleus net
- canonical/siemens nucleus source code
- canonical/siemens pluscontrol 1st gen
- canonical/siemens nucleus readystart
- vendor/arm
- canonical/arm arm
- vendor/mips
- canonical/mips mips
- vendor/powerpc project
- canonical/powerpc project powerpc