{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-27737"
    }
  },
  "description": "SIMOTICS CONNECT 400\u662f\u4e00\u4e2a\u8fde\u63a5\u5668\u548c\u4f20\u611f\u5668\u76d2\uff0c\u5b89\u88c5\u5728\u4f4e\u538b\u7535\u673a\u4e0a\uff0c\u4e3aMindSphere\u5e94\u7528\u7a0b\u5e8fSIDRIVE IQ Fleet\u63d0\u4f9b\u5206\u6790\u6570\u636e\u3002\n\nSiemens SIMOTICS CONNECT 400\u5b58\u5728\u8d8a\u754c\u8bfb\u53d6\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u9020\u6210\u62d2\u7edd\u670d\u52a1\u60c5\u51b5\uff0c\u6216\u901a\u8fc7\u5206\u914d\u7684\u7ed3\u6784\u6cc4\u9732\u5185\u5b58\u3002",
  "formalWay": "\u7528\u6237\u53ef\u53c2\u8003\u5982\u4e0b\u4f9b\u5e94\u5546\u63d0\u4f9b\u7684\u5b89\u5168\u516c\u544a\u83b7\u5f97\u8865\u4e01\u4fe1\u606f\uff1a\r\nhttps://cert-portal.siemens.com/productcert/pdf/ssa-669158.pdf",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-28706",
  "openTime": "2021-04-15",
  "patchDescription": "SIMOTICS CONNECT 400\u662f\u4e00\u4e2a\u8fde\u63a5\u5668\u548c\u4f20\u611f\u5668\u76d2\uff0c\u5b89\u88c5\u5728\u4f4e\u538b\u7535\u673a\u4e0a\uff0c\u4e3aMindSphere\u5e94\u7528\u7a0b\u5e8fSIDRIVE IQ Fleet\u63d0\u4f9b\u5206\u6790\u6570\u636e\u3002\r\n\r\nSiemens SIMOTICS CONNECT 400\u5b58\u5728\u8d8a\u754c\u8bfb\u53d6\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u9020\u6210\u62d2\u7edd\u670d\u52a1\u60c5\u51b5\uff0c\u6216\u901a\u8fc7\u5206\u914d\u7684\u7ed3\u6784\u6cc4\u9732\u5185\u5b58\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Siemens SIMOTICS CONNECT 400\u8d8a\u754c\u8bfb\u53d6\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Siemens SIMOTICS CONNECT 400 \u003c V0.5.0.0"
  },
  "referenceLink": "https://cert-portal.siemens.com/productcert/pdf/ssa-669158.pdf",
  "serverity": "\u4e2d",
  "submitTime": "2021-04-15",
  "title": "Siemens SIMOTICS CONNECT 400\u8d8a\u754c\u8bfb\u53d6\u6f0f\u6d1e"
}

{
  "document": {
    "acknowledgments": [
      {
        "organization": "Siemens ProductCERT",
        "summary": "reporting this vulnerability to CISA."
      },
      {
        "names": [
          "Daniel dos Santos"
        ],
        "organization": "Forescout Technologies Inc.",
        "summary": "coordinated disclosure"
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp/"
      }
    },
    "notes": [
      {
        "category": "summary",
        "text": "SIMOTICS CONNECT 400 is affected by DNS Client vulnerabilities as initially reported in Siemens Security Advisory SSA-705111 (https://cert-portal.siemens.com/productcert/pdf/ssa-705111.pdf) for the DNS Module in Nucleus RTOS.\n\nSiemens has released updates for the SIMOTICS CONNECT 400 and recommends to update to the latest version.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
        "title": "Terms of Use"
      },
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "other",
        "text": "This CISA CSAF advisory was converted from Siemens ProductCERT\u0027s CSAF advisory.",
        "title": "Advisory Conversion Disclaimer"
      },
      {
        "category": "other",
        "text": "Multiple",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "Germany",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "central@cisa.dhs.gov",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-669158: DNS Client Vulnerabilities in SIMOTICS CONNECT 400 - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-669158.json"
      },
      {
        "category": "self",
        "summary": "SSA-669158: DNS Client Vulnerabilities in SIMOTICS CONNECT 400 - TXT Version",
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-669158.txt"
      },
      {
        "category": "self",
        "summary": "SSA-669158: DNS Client Vulnerabilities in SIMOTICS CONNECT 400 - PDF Version",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-669158.pdf"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-21-103-13 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2021/icsa-21-103-13.json"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-21-103-13 - Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-103-13"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/topics/industrial-control-systems"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
      }
    ],
    "title": "Siemens SIMOTICS CONNECT 400 (Update A)",
    "tracking": {
      "current_release_date": "2025-05-06T06:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ICSA-21-103-13",
      "initial_release_date": "2021-04-13T00:00:00.000000Z",
      "revision_history": [
        {
          "date": "2021-04-13T00:00:00.000000Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        },
        {
          "date": "2022-03-08T00:00:00.000000Z",
          "legacy_version": "1.1",
          "number": "2",
          "summary": "Added solution for CVE-2021-25677"
        },
        {
          "date": "2025-05-06T06:00:00.000000Z",
          "legacy_version": "Revision",
          "number": "3",
          "summary": "Revision - Fixing typos"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV0.5.0.0",
                "product": {
                  "name": "SIMOTICS CONNECT 400",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMOTICS CONNECT 400"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003e=V0.5.0.0_\u003cV1.0.0.0",
                "product": {
                  "name": "SIMOTICS CONNECT 400",
                  "product_id": "CSAFPID-0002"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMOTICS CONNECT 400"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-27736",
      "cwe": {
        "id": "CWE-170",
        "name": "Improper Null Termination"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The DNS domain name label parsing functionality does not properly validate the null-terminated name in DNS-responses. The parsing of malformed responses could result in a read past the end of an allocated structure. An attacker with a privileged position in the network could leverage this vulnerability to cause a denial-of-service condition or leak the read memory.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "summary": "CVE-2020-27736 - SIMOTICS CONNECT 400",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109778383/"
        },
        {
          "summary": "CVE-2020-27736 Mitre 5.0 json",
          "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2020-27736.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V0.5.0.0 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109778383/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2020-27736"
    },
    {
      "cve": "CVE-2020-27737",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The DNS response parsing functionality does not properly validate various length and counts of the records. The parsing of malformed responses could result in a read past the end of an allocated structure. An attacker with a privileged position in the network could leverage this vulnerability to cause a denial-of-service condition or leak the memory past the allocated structure.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "summary": "CVE-2020-27737 - SIMOTICS CONNECT 400",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109778383/"
        },
        {
          "summary": "CVE-2020-27737 Mitre 5.0 json",
          "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2020-27737.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V0.5.0.0 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109778383/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2020-27737"
    },
    {
      "cve": "CVE-2020-27738",
      "cwe": {
        "id": "CWE-788",
        "name": "Access of Memory Location After End of Buffer"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The DNS domain name record decompression functionality does not properly validate the pointer offset values. The parsing of malformed responses could result in a read access past the end of an allocated structure. An attacker with a privileged position in the network could leverage this vulnerability to cause a denial-of-service condition.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "summary": "CVE-2020-27738 - SIMOTICS CONNECT 400",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109778383/"
        },
        {
          "summary": "CVE-2020-27738 Mitre 5.0 json",
          "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2020-27738.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V0.5.0.0 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109778383/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2020-27738"
    },
    {
      "cve": "CVE-2021-25677",
      "cwe": {
        "id": "CWE-330",
        "name": "Use of Insufficiently Random Values"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The DNS client does not properly randomize DNS transaction IDs. That could allow an attacker to poison the DNS cache or spoof DNS resolving.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "summary": "CVE-2021-25677 - SIMOTICS CONNECT 400",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109778383/"
        },
        {
          "summary": "CVE-2021-25677 - SIMOTICS CONNECT 400",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109778383/"
        },
        {
          "summary": "CVE-2021-25677 Mitre 5.0 json",
          "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-25677.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V0.5.0.0 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109778383/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V1.0.0.0 or later version",
          "product_ids": [
            "CSAFPID-0002"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109778383/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-2021-25677"
    }
  ]
}

{
  "document": {
    "acknowledgments": [
      {
        "organization": "Siemens ProductCERT",
        "summary": "reporting these vulnerabilities to CISA."
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "APOGEE PXC / TALON TC field panels (BACnet before V3.5.5 and P2 Ethernet before V2.8.20) contain multiple vulnerabilities:\n\n- CVE-2022-45937: A privilege management vulnerability that could allow low privilege authenticated attackers to gain high privilege access.\n- CVE-2020-28388: Predictable Initial Sequence Numbers in the TCP/IP Stack of Nucleus RTOS (real-time operating system) used by the affected products.\n- Several vulnerabilities in the DNS (domain name service) implementation of Nucleus RTOS.\n\nSiemens has released updates for the affected products and recommends to update to the latest versions.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure Siemens strongly recommends to protect network access to affected products with appropriate mechanisms. It is advised to follow recommended security practices in order to run the devices in a protected IT environment.",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
        "title": "Terms of Use"
      },
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "other",
        "text": "This CISA CSAF advisory was converted from Siemens ProductCERT\u0027s CSAF advisory.",
        "title": "Advisory Conversion Disclaimer"
      },
      {
        "category": "other",
        "text": "Multiple",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "Germany",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "central@cisa.dhs.gov",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-180579: Privilege Management Vulnerability and Multiple Nucleus RTOS Vulnerabilities in APOGEE/TALON Field Panels before V3.5.5/V2.8.20 - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-180579.json"
      },
      {
        "category": "self",
        "summary": "SSA-180579: Privilege Management Vulnerability and Multiple Nucleus RTOS Vulnerabilities in APOGEE/TALON Field Panels before V3.5.5/V2.8.20 - HTML Version",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-180579.html"
      },
      {
        "category": "self",
        "summary": "SSA-180579: Privilege Management Vulnerability and Multiple Nucleus RTOS Vulnerabilities in APOGEE/TALON Field Panels before V3.5.5/V2.8.20 - PDF Version",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-180579.pdf"
      },
      {
        "category": "self",
        "summary": "SSA-180579: Privilege Management Vulnerability and Multiple Nucleus RTOS Vulnerabilities in APOGEE/TALON Field Panels before V3.5.5/V2.8.20 - TXT Version",
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-180579.txt"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-22-349-16 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2022/icsa-22-349-16.json"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-22-349-16 - Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-22-349-16"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/topics/industrial-control-systems"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
      }
    ],
    "title": "Siemens APOGEE and TALON",
    "tracking": {
      "current_release_date": "2025-05-06T06:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ICSA-22-349-16",
      "initial_release_date": "2022-12-13T00:00:00.000000Z",
      "revision_history": [
        {
          "date": "2022-12-13T00:00:00.000000Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        },
        {
          "date": "2023-08-08T00:00:00.000000Z",
          "legacy_version": "1.1",
          "number": "2",
          "summary": "Added additional vulnerabilities that were fixed in the same product versions (V3.5.5 / V2.8.20)"
        },
        {
          "date": "2025-05-06T06:00:00.000000Z",
          "legacy_version": "Revision",
          "number": "3",
          "summary": "Revision - Fixing typos"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV3.5.5",
                "product": {
                  "name": "APOGEE PXC Compact (BACnet)",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "APOGEE PXC Compact (BACnet)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV2.8.20",
                "product": {
                  "name": "APOGEE PXC Compact (P2 Ethernet)",
                  "product_id": "CSAFPID-0002"
                }
              }
            ],
            "category": "product_name",
            "name": "APOGEE PXC Compact (P2 Ethernet)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV3.5.5",
                "product": {
                  "name": "APOGEE PXC Modular (BACnet)",
                  "product_id": "CSAFPID-0003"
                }
              }
            ],
            "category": "product_name",
            "name": "APOGEE PXC Modular (BACnet)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV2.8.20",
                "product": {
                  "name": "APOGEE PXC Modular (P2 Ethernet)",
                  "product_id": "CSAFPID-0004"
                }
              }
            ],
            "category": "product_name",
            "name": "APOGEE PXC Modular (P2 Ethernet)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV3.5.5",
                "product": {
                  "name": "TALON TC Compact (BACnet)",
                  "product_id": "CSAFPID-0005"
                }
              }
            ],
            "category": "product_name",
            "name": "TALON TC Compact (BACnet)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV3.5.5",
                "product": {
                  "name": "TALON TC Modular (BACnet)",
                  "product_id": "CSAFPID-0006"
                }
              }
            ],
            "category": "product_name",
            "name": "TALON TC Modular (BACnet)"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-15795",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The DNS domain name label parsing functionality does not properly validate the names in DNS-responses. The parsing of malformed responses could result in a write past the end of an allocated structure. An attacker with a privileged position in the network could leverage this vulnerability to execute code in the context of the current process or cause a denial-of-service condition.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.8.20 or later version",
          "product_ids": [
            "CSAFPID-0002",
            "CSAFPID-0004"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V3.5.5 or later version",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0005",
            "CSAFPID-0006"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006"
          ]
        }
      ],
      "title": "CVE-2020-15795"
    },
    {
      "cve": "CVE-2020-27009",
      "cwe": {
        "id": "CWE-823",
        "name": "Use of Out-of-range Pointer Offset"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The DNS domain name record decompression functionality does not properly validate the pointer offset values. The parsing of malformed responses could result in a write past the end of an allocated structure. An attacker with a privileged position in the network could leverage this vulnerability to execute code in the context of the current process or cause a denial-of-service condition.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.8.20 or later version",
          "product_ids": [
            "CSAFPID-0002",
            "CSAFPID-0004"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V3.5.5 or later version",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0005",
            "CSAFPID-0006"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006"
          ]
        }
      ],
      "title": "CVE-2020-27009"
    },
    {
      "cve": "CVE-2020-27736",
      "cwe": {
        "id": "CWE-170",
        "name": "Improper Null Termination"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The DNS domain name label parsing functionality does not properly validate the null-terminated name in DNS-responses. The parsing of malformed responses could result in a read past the end of an allocated structure. An attacker with a privileged position in the network could leverage this vulnerability to cause a denial-of-service condition or leak the read memory.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.8.20 or later version",
          "product_ids": [
            "CSAFPID-0002",
            "CSAFPID-0004"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V3.5.5 or later version",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0005",
            "CSAFPID-0006"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006"
          ]
        }
      ],
      "title": "CVE-2020-27736"
    },
    {
      "cve": "CVE-2020-27737",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The DNS response parsing functionality does not properly validate various length and counts of the records. The parsing of malformed responses could result in a read past the end of an allocated structure. An attacker with a privileged position in the network could leverage this vulnerability to cause a denial-of-service condition  or leak the memory past the allocated structure.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.8.20 or later version",
          "product_ids": [
            "CSAFPID-0002",
            "CSAFPID-0004"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V3.5.5 or later version",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0005",
            "CSAFPID-0006"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006"
          ]
        }
      ],
      "title": "CVE-2020-27737"
    },
    {
      "cve": "CVE-2020-27738",
      "cwe": {
        "id": "CWE-788",
        "name": "Access of Memory Location After End of Buffer"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The DNS domain name record decompression functionality does not properly validate the pointer offset values. The parsing of malformed responses could result in a read access past the end of an allocated structure. An attacker with a privileged position in the network could leverage this vulnerability to cause a denial-of-service condition.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.8.20 or later version",
          "product_ids": [
            "CSAFPID-0002",
            "CSAFPID-0004"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V3.5.5 or later version",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0005",
            "CSAFPID-0006"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006"
          ]
        }
      ],
      "title": "CVE-2020-27738"
    },
    {
      "cve": "CVE-2020-28388",
      "cwe": {
        "id": "CWE-342",
        "name": "Predictable Exact Value from Previous Values"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Initial Sequence Numbers (ISNs) for TCP connections are derived from an insufficiently random source. As a result, the ISN of current and future TCP connections could be predictable. An attacker could hijack existing sessions or spoof future ones.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.8.20 or later version",
          "product_ids": [
            "CSAFPID-0002",
            "CSAFPID-0004"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V3.5.5 or later version",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0005",
            "CSAFPID-0006"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006"
          ]
        }
      ],
      "title": "CVE-2020-28388"
    },
    {
      "cve": "CVE-2021-25677",
      "cwe": {
        "id": "CWE-330",
        "name": "Use of Insufficiently Random Values"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The DNS client does not properly randomize DNS transaction IDs. That could allow an attacker to poison the DNS cache or spoof DNS resolving.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.8.20 or later version",
          "product_ids": [
            "CSAFPID-0002",
            "CSAFPID-0004"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V3.5.5 or later version",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0005",
            "CSAFPID-0006"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006"
          ]
        }
      ],
      "title": "CVE-2021-25677"
    },
    {
      "cve": "CVE-2022-45937",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A low privilege authenticated attacker with network access to the integrated web server could download sensitive information from the device containing user account credentials.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.8.20 or later version",
          "product_ids": [
            "CSAFPID-0002",
            "CSAFPID-0004"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V3.5.5 or later version",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0005",
            "CSAFPID-0006"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006"
          ]
        }
      ],
      "title": "CVE-2022-45937"
    }
  ]
}

{
  "document": {
    "acknowledgments": [
      {
        "organization": "Siemens ProductCERT",
        "summary": "reporting this vulnerability to CISA."
      },
      {
        "names": [
          "Daniel dos Santos"
        ],
        "organization": "Forescout Technologies Inc.",
        "summary": "coordinated disclosure"
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp/"
      }
    },
    "notes": [
      {
        "category": "summary",
        "text": "SIMOTICS CONNECT 400 is affected by DNS Client vulnerabilities as initially reported in Siemens Security Advisory SSA-705111 (https://cert-portal.siemens.com/productcert/pdf/ssa-705111.pdf) for the DNS Module in Nucleus RTOS.\n\nSiemens has released updates for the SIMOTICS CONNECT 400 and recommends to update to the latest version.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
        "title": "Terms of Use"
      },
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "other",
        "text": "This CISA CSAF advisory was converted from Siemens ProductCERT\u0027s CSAF advisory.",
        "title": "Advisory Conversion Disclaimer"
      },
      {
        "category": "other",
        "text": "Multiple",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "Germany",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "central@cisa.dhs.gov",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-669158: DNS Client Vulnerabilities in SIMOTICS CONNECT 400 - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-669158.json"
      },
      {
        "category": "self",
        "summary": "SSA-669158: DNS Client Vulnerabilities in SIMOTICS CONNECT 400 - TXT Version",
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-669158.txt"
      },
      {
        "category": "self",
        "summary": "SSA-669158: DNS Client Vulnerabilities in SIMOTICS CONNECT 400 - PDF Version",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-669158.pdf"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-21-103-13 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2021/icsa-21-103-13.json"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-21-103-13 - Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-103-13"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/topics/industrial-control-systems"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
      }
    ],
    "title": "Siemens SIMOTICS CONNECT 400 (Update A)",
    "tracking": {
      "current_release_date": "2025-05-06T06:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ICSA-21-103-13",
      "initial_release_date": "2021-04-13T00:00:00.000000Z",
      "revision_history": [
        {
          "date": "2021-04-13T00:00:00.000000Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        },
        {
          "date": "2022-03-08T00:00:00.000000Z",
          "legacy_version": "1.1",
          "number": "2",
          "summary": "Added solution for CVE-2021-25677"
        },
        {
          "date": "2025-05-06T06:00:00.000000Z",
          "legacy_version": "Revision",
          "number": "3",
          "summary": "Revision - Fixing typos"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV0.5.0.0",
                "product": {
                  "name": "SIMOTICS CONNECT 400",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMOTICS CONNECT 400"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003e=V0.5.0.0_\u003cV1.0.0.0",
                "product": {
                  "name": "SIMOTICS CONNECT 400",
                  "product_id": "CSAFPID-0002"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMOTICS CONNECT 400"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-27736",
      "cwe": {
        "id": "CWE-170",
        "name": "Improper Null Termination"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The DNS domain name label parsing functionality does not properly validate the null-terminated name in DNS-responses. The parsing of malformed responses could result in a read past the end of an allocated structure. An attacker with a privileged position in the network could leverage this vulnerability to cause a denial-of-service condition or leak the read memory.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "summary": "CVE-2020-27736 - SIMOTICS CONNECT 400",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109778383/"
        },
        {
          "summary": "CVE-2020-27736 Mitre 5.0 json",
          "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2020-27736.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V0.5.0.0 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109778383/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2020-27736"
    },
    {
      "cve": "CVE-2020-27737",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The DNS response parsing functionality does not properly validate various length and counts of the records. The parsing of malformed responses could result in a read past the end of an allocated structure. An attacker with a privileged position in the network could leverage this vulnerability to cause a denial-of-service condition or leak the memory past the allocated structure.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "summary": "CVE-2020-27737 - SIMOTICS CONNECT 400",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109778383/"
        },
        {
          "summary": "CVE-2020-27737 Mitre 5.0 json",
          "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2020-27737.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V0.5.0.0 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109778383/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2020-27737"
    },
    {
      "cve": "CVE-2020-27738",
      "cwe": {
        "id": "CWE-788",
        "name": "Access of Memory Location After End of Buffer"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The DNS domain name record decompression functionality does not properly validate the pointer offset values. The parsing of malformed responses could result in a read access past the end of an allocated structure. An attacker with a privileged position in the network could leverage this vulnerability to cause a denial-of-service condition.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "summary": "CVE-2020-27738 - SIMOTICS CONNECT 400",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109778383/"
        },
        {
          "summary": "CVE-2020-27738 Mitre 5.0 json",
          "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2020-27738.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V0.5.0.0 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109778383/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2020-27738"
    },
    {
      "cve": "CVE-2021-25677",
      "cwe": {
        "id": "CWE-330",
        "name": "Use of Insufficiently Random Values"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The DNS client does not properly randomize DNS transaction IDs. That could allow an attacker to poison the DNS cache or spoof DNS resolving.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "summary": "CVE-2021-25677 - SIMOTICS CONNECT 400",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109778383/"
        },
        {
          "summary": "CVE-2021-25677 - SIMOTICS CONNECT 400",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109778383/"
        },
        {
          "summary": "CVE-2021-25677 Mitre 5.0 json",
          "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-25677.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V0.5.0.0 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109778383/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V1.0.0.0 or later version",
          "product_ids": [
            "CSAFPID-0002"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109778383/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-2021-25677"
    }
  ]
}

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:siemens:simotics_connect_400_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F02FDCB9-0149-4EFA-9DBA-045C4AD84EC0",
              "versionEndExcluding": "0.5.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:siemens:simotics_connect_400:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "48BFF9EF-D1C1-4107-8D1E-51315C03FFF0",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:siemens:nucleus_net:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "7A987CFB-4A41-4F82-8C7F-31DE8F0650DE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:siemens:nucleus_readystart_v3:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "EC33F30E-EEA1-452E-8EFE-28ADA88E3F56",
              "versionEndExcluding": "2017.02.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:siemens:nucleus_readystart_v4:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B35FDE44-BE25-431D-B2EE-195ACC5A606C",
              "versionEndExcluding": "4.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:siemens:nucleus_source_code:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "53A38C64-612A-4BC5-83D5-D3FA1C90E0F7",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions \u003c V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions \u003c V2.8.20), APOGEE PXC Modular (BACnet) (All versions \u003c V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions \u003c V2.8.20), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions \u003c V2017.02.3), Nucleus ReadyStart V4 (All versions \u003c V4.1.0), Nucleus Source Code (Versions including affected DNS modules), SIMOTICS CONNECT 400 (All versions \u003c V0.5.0.0), TALON TC Compact (BACnet) (All versions \u003c V3.5.5), TALON TC Modular (BACnet) (All versions \u003c V3.5.5). The DNS response parsing functionality does not properly validate various length and counts of the records. The parsing of malformed responses could result in a read past the end of an allocated structure. An attacker with a privileged position in the network could leverage this vulnerability to cause a denial-of-service condition  or leak the memory past the allocated structure."
    },
    {
      "lang": "es",
      "value": "Se ha identificado una vulnerabilidad en Nucleus NET (Todas las versiones), Nucleus ReadyStart V3 (Todas las versiones anteriores a la versi\u00f3n V2017.02.3), Nucleus ReadyStart V4 (Todas las versiones anteriores a la versi\u00f3n V4.1.0), Nucleus Source Code (Versiones que incluyen los m\u00f3dulos DNS afectados), SIMOTICS CONNECT 400 (Todas las versiones anteriores a la versi\u00f3n V0.5.0.0). La funcionalidad de an\u00e1lisis de la respuesta DNS no valida correctamente varias longitudes y recuentos de los registros. El an\u00e1lisis sint\u00e1ctico de respuestas malformadas podr\u00eda dar lugar a una lectura m\u00e1s all\u00e1 del final de una estructura asignada. Un atacante con una posici\u00f3n privilegiada en la red podr\u00eda aprovechar esta vulnerabilidad para causar una condici\u00f3n de denegaci\u00f3n de servicio o filtrar la memoria m\u00e1s all\u00e1 de la estructura asignada"
    }
  ],
  "id": "CVE-2020-27737",
  "lastModified": "2024-11-21T05:21:43.447",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 5.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 4.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 4.2,
        "source": "productcert@siemens.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 4.2,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2021-04-22T21:15:09.280",
  "references": [
    {
      "source": "productcert@siemens.com",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-180579.pdf"
    },
    {
      "source": "productcert@siemens.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-669158.pdf"
    },
    {
      "source": "productcert@siemens.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-705111.pdf"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-180579.pdf"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-669158.pdf"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-705111.pdf"
    }
  ],
  "sourceIdentifier": "productcert@siemens.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ],
      "source": "productcert@siemens.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Nucleus Net ist der Netzwerk-Stack f\u00fcr das Nucleus RTOS Echtzeitbetriebssystem.\r\nNucleus RTOS ist ein Echtzeitbetriebssystem f\u00fcr Embedded Devices.\r\nAzure RTOS NetX ist ein TCP/IP IPv4 Embedded Network Stack, der f\u00fcr Embedded-, Echtzeit- und IoT-Anwendungen entwickelt wurde. \r\nVxWorks ist ein propriet\u00e4res Echtzeitbetriebssystem, das von Wind River Systems entwickelt wird.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Siemens Nucleus Net, Siemens Nucleus RTOS, Microsoft Azure RTOS NetX und Wind River VxWorks ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuf\u00fchren oder einen Denial of Service zu verursachen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2023-1986 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2021/wid-sec-w-2023-1986.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2023-1986 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-1986"
      },
      {
        "category": "external",
        "summary": "Forescout Report vom 2021-04-15",
        "url": "https://www.forescout.com/company/resources/namewreck-breaking-and-fixing-dns-implementations/"
      },
      {
        "category": "external",
        "summary": "Siemens Security Advisory by Siemens ProductCERT",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-185699.pdf"
      },
      {
        "category": "external",
        "summary": "Siemens Security Advisory by Siemens ProductCERT",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-705111.pdf"
      },
      {
        "category": "external",
        "summary": "Siemens Security Advisory SSA-180579 vom 2023-08-08",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-180579.html"
      },
      {
        "category": "external",
        "summary": "Siemens Security Advisory SSA-248289 vom 2024-02-13",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-248289.html"
      }
    ],
    "source_lang": "en-US",
    "title": "NAME:WRECK: Mehrere Schwachstellen in TCP/IP Stacks",
    "tracking": {
      "current_release_date": "2024-02-12T23:00:00.000+00:00",
      "generator": {
        "date": "2024-08-15T17:56:40.873+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.5"
        }
      },
      "id": "WID-SEC-W-2023-1986",
      "initial_release_date": "2021-04-15T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2021-04-15T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2021-05-02T22:00:00.000+00:00",
          "number": "2",
          "summary": "CVE\u0027s erg\u00e4nzt"
        },
        {
          "date": "2021-11-08T23:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von Siemens aufgenommen"
        },
        {
          "date": "2023-08-07T22:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von Siemens aufgenommen"
        },
        {
          "date": "2024-02-12T23:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von Siemens aufgenommen"
        }
      ],
      "status": "final",
      "version": "5"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Microsoft Azure RTOS NetX",
            "product": {
              "name": "Microsoft Azure RTOS NetX",
              "product_id": "T018910",
              "product_identification_helper": {
                "cpe": "cpe:/o:microsoft:azure_rtos_netx:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Siemens Nucleus Net",
            "product": {
              "name": "Siemens Nucleus Net",
              "product_id": "683157",
              "product_identification_helper": {
                "cpe": "cpe:/a:siemens:nucleus_net:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Siemens Nucleus RTOS",
            "product": {
              "name": "Siemens Nucleus RTOS",
              "product_id": "683163",
              "product_identification_helper": {
                "cpe": "cpe:/o:siemens:nucleus_rtos:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Wind River VxWorks",
            "product": {
              "name": "Wind River VxWorks",
              "product_id": "T018911",
              "product_identification_helper": {
                "cpe": "cpe:/o:windriver:vxworks:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Wind River"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2016-20009",
      "notes": [
        {
          "category": "description",
          "text": "In der DNS-Implementierung in weitgenutzten TCP/IP Stacks bestehen mehrere Schwachstellen, die sich in Server-Anwendungen, aber auch IoT und OT-Devices befinden. Sie basieren gr\u00f6\u00dftenteils auf Fehlern in der Kompressionsfunktion der DNS-Implementierung. Ein entfernter anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code mit Administratorrechten zur Ausf\u00fchrung zu bringen oder einen Denial of Service zu verursachen."
        }
      ],
      "product_status": {
        "known_affected": [
          "683157",
          "T018910",
          "T018911",
          "683163"
        ]
      },
      "release_date": "2021-04-15T22:00:00.000+00:00",
      "title": "CVE-2016-20009"
    },
    {
      "cve": "CVE-2020-15795",
      "notes": [
        {
          "category": "description",
          "text": "In der DNS-Implementierung in weitgenutzten TCP/IP Stacks bestehen mehrere Schwachstellen, die sich in Server-Anwendungen, aber auch IoT und OT-Devices befinden. Sie basieren gr\u00f6\u00dftenteils auf Fehlern in der Kompressionsfunktion der DNS-Implementierung. Ein entfernter anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code mit Administratorrechten zur Ausf\u00fchrung zu bringen oder einen Denial of Service zu verursachen."
        }
      ],
      "product_status": {
        "known_affected": [
          "683157",
          "T018910",
          "T018911",
          "683163"
        ]
      },
      "release_date": "2021-04-15T22:00:00.000+00:00",
      "title": "CVE-2020-15795"
    },
    {
      "cve": "CVE-2020-27009",
      "notes": [
        {
          "category": "description",
          "text": "In der DNS-Implementierung in weitgenutzten TCP/IP Stacks bestehen mehrere Schwachstellen, die sich in Server-Anwendungen, aber auch IoT und OT-Devices befinden. Sie basieren gr\u00f6\u00dftenteils auf Fehlern in der Kompressionsfunktion der DNS-Implementierung. Ein entfernter anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code mit Administratorrechten zur Ausf\u00fchrung zu bringen oder einen Denial of Service zu verursachen."
        }
      ],
      "product_status": {
        "known_affected": [
          "683157",
          "T018910",
          "T018911",
          "683163"
        ]
      },
      "release_date": "2021-04-15T22:00:00.000+00:00",
      "title": "CVE-2020-27009"
    },
    {
      "cve": "CVE-2020-27736",
      "notes": [
        {
          "category": "description",
          "text": "In der DNS-Implementierung in weitgenutzten TCP/IP Stacks bestehen mehrere Schwachstellen, die sich in Server-Anwendungen, aber auch IoT und OT-Devices befinden. Sie basieren gr\u00f6\u00dftenteils auf Fehlern in der Kompressionsfunktion der DNS-Implementierung. Ein entfernter anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code mit Administratorrechten zur Ausf\u00fchrung zu bringen oder einen Denial of Service zu verursachen."
        }
      ],
      "product_status": {
        "known_affected": [
          "683157",
          "T018910",
          "T018911",
          "683163"
        ]
      },
      "release_date": "2021-04-15T22:00:00.000+00:00",
      "title": "CVE-2020-27736"
    },
    {
      "cve": "CVE-2020-27737",
      "notes": [
        {
          "category": "description",
          "text": "In der DNS-Implementierung in weitgenutzten TCP/IP Stacks bestehen mehrere Schwachstellen, die sich in Server-Anwendungen, aber auch IoT und OT-Devices befinden. Sie basieren gr\u00f6\u00dftenteils auf Fehlern in der Kompressionsfunktion der DNS-Implementierung. Ein entfernter anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code mit Administratorrechten zur Ausf\u00fchrung zu bringen oder einen Denial of Service zu verursachen."
        }
      ],
      "product_status": {
        "known_affected": [
          "683157",
          "T018910",
          "T018911",
          "683163"
        ]
      },
      "release_date": "2021-04-15T22:00:00.000+00:00",
      "title": "CVE-2020-27737"
    },
    {
      "cve": "CVE-2020-27738",
      "notes": [
        {
          "category": "description",
          "text": "In der DNS-Implementierung in weitgenutzten TCP/IP Stacks bestehen mehrere Schwachstellen, die sich in Server-Anwendungen, aber auch IoT und OT-Devices befinden. Sie basieren gr\u00f6\u00dftenteils auf Fehlern in der Kompressionsfunktion der DNS-Implementierung. Ein entfernter anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code mit Administratorrechten zur Ausf\u00fchrung zu bringen oder einen Denial of Service zu verursachen."
        }
      ],
      "product_status": {
        "known_affected": [
          "683157",
          "T018910",
          "T018911",
          "683163"
        ]
      },
      "release_date": "2021-04-15T22:00:00.000+00:00",
      "title": "CVE-2020-27738"
    },
    {
      "cve": "CVE-2021-25663",
      "notes": [
        {
          "category": "description",
          "text": "In der DNS-Implementierung in weitgenutzten TCP/IP Stacks bestehen mehrere Schwachstellen, die sich in Server-Anwendungen, aber auch IoT und OT-Devices befinden. Sie basieren gr\u00f6\u00dftenteils auf Fehlern in der Kompressionsfunktion der DNS-Implementierung. Ein entfernter anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code mit Administratorrechten zur Ausf\u00fchrung zu bringen oder einen Denial of Service zu verursachen."
        }
      ],
      "product_status": {
        "known_affected": [
          "683157",
          "T018910",
          "T018911",
          "683163"
        ]
      },
      "release_date": "2021-04-15T22:00:00.000+00:00",
      "title": "CVE-2021-25663"
    },
    {
      "cve": "CVE-2021-25664",
      "notes": [
        {
          "category": "description",
          "text": "In der DNS-Implementierung in weitgenutzten TCP/IP Stacks bestehen mehrere Schwachstellen, die sich in Server-Anwendungen, aber auch IoT und OT-Devices befinden. Sie basieren gr\u00f6\u00dftenteils auf Fehlern in der Kompressionsfunktion der DNS-Implementierung. Ein entfernter anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code mit Administratorrechten zur Ausf\u00fchrung zu bringen oder einen Denial of Service zu verursachen."
        }
      ],
      "product_status": {
        "known_affected": [
          "683157",
          "T018910",
          "T018911",
          "683163"
        ]
      },
      "release_date": "2021-04-15T22:00:00.000+00:00",
      "title": "CVE-2021-25664"
    },
    {
      "cve": "CVE-2021-25677",
      "notes": [
        {
          "category": "description",
          "text": "In der DNS-Implementierung in weitgenutzten TCP/IP Stacks bestehen mehrere Schwachstellen, die sich in Server-Anwendungen, aber auch IoT und OT-Devices befinden. Sie basieren gr\u00f6\u00dftenteils auf Fehlern in der Kompressionsfunktion der DNS-Implementierung. Ein entfernter anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code mit Administratorrechten zur Ausf\u00fchrung zu bringen oder einen Denial of Service zu verursachen."
        }
      ],
      "product_status": {
        "known_affected": [
          "683157",
          "T018910",
          "T018911",
          "683163"
        ]
      },
      "release_date": "2021-04-15T22:00:00.000+00:00",
      "title": "CVE-2021-25677"
    },
    {
      "cve": "CVE-2021-27393",
      "notes": [
        {
          "category": "description",
          "text": "In der DNS-Implementierung in weitgenutzten TCP/IP Stacks bestehen mehrere Schwachstellen, die sich in Server-Anwendungen, aber auch IoT und OT-Devices befinden. Sie basieren gr\u00f6\u00dftenteils auf Fehlern in der Kompressionsfunktion der DNS-Implementierung. Ein entfernter anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code mit Administratorrechten zur Ausf\u00fchrung zu bringen oder einen Denial of Service zu verursachen."
        }
      ],
      "product_status": {
        "known_affected": [
          "683157",
          "T018910",
          "T018911",
          "683163"
        ]
      },
      "release_date": "2021-04-15T22:00:00.000+00:00",
      "title": "CVE-2021-27393"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Nucleus Net ist der Netzwerk-Stack f\u00fcr das Nucleus RTOS Echtzeitbetriebssystem.\r\nNucleus RTOS ist ein Echtzeitbetriebssystem f\u00fcr Embedded Devices.\r\nAzure RTOS NetX ist ein TCP/IP IPv4 Embedded Network Stack, der f\u00fcr Embedded-, Echtzeit- und IoT-Anwendungen entwickelt wurde. \r\nVxWorks ist ein propriet\u00e4res Echtzeitbetriebssystem, das von Wind River Systems entwickelt wird.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Siemens Nucleus Net, Siemens Nucleus RTOS, Microsoft Azure RTOS NetX und Wind River VxWorks ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuf\u00fchren oder einen Denial of Service zu verursachen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2023-1986 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2021/wid-sec-w-2023-1986.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2023-1986 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-1986"
      },
      {
        "category": "external",
        "summary": "Forescout Report vom 2021-04-15",
        "url": "https://www.forescout.com/company/resources/namewreck-breaking-and-fixing-dns-implementations/"
      },
      {
        "category": "external",
        "summary": "Siemens Security Advisory by Siemens ProductCERT",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-185699.pdf"
      },
      {
        "category": "external",
        "summary": "Siemens Security Advisory by Siemens ProductCERT",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-705111.pdf"
      },
      {
        "category": "external",
        "summary": "Siemens Security Advisory SSA-180579 vom 2023-08-08",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-180579.html"
      },
      {
        "category": "external",
        "summary": "Siemens Security Advisory SSA-248289 vom 2024-02-13",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-248289.html"
      }
    ],
    "source_lang": "en-US",
    "title": "NAME:WRECK: Mehrere Schwachstellen in TCP/IP Stacks",
    "tracking": {
      "current_release_date": "2024-02-12T23:00:00.000+00:00",
      "generator": {
        "date": "2024-08-15T17:56:40.873+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.5"
        }
      },
      "id": "WID-SEC-W-2023-1986",
      "initial_release_date": "2021-04-15T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2021-04-15T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2021-05-02T22:00:00.000+00:00",
          "number": "2",
          "summary": "CVE\u0027s erg\u00e4nzt"
        },
        {
          "date": "2021-11-08T23:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von Siemens aufgenommen"
        },
        {
          "date": "2023-08-07T22:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von Siemens aufgenommen"
        },
        {
          "date": "2024-02-12T23:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von Siemens aufgenommen"
        }
      ],
      "status": "final",
      "version": "5"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Microsoft Azure RTOS NetX",
            "product": {
              "name": "Microsoft Azure RTOS NetX",
              "product_id": "T018910",
              "product_identification_helper": {
                "cpe": "cpe:/o:microsoft:azure_rtos_netx:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Siemens Nucleus Net",
            "product": {
              "name": "Siemens Nucleus Net",
              "product_id": "683157",
              "product_identification_helper": {
                "cpe": "cpe:/a:siemens:nucleus_net:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Siemens Nucleus RTOS",
            "product": {
              "name": "Siemens Nucleus RTOS",
              "product_id": "683163",
              "product_identification_helper": {
                "cpe": "cpe:/o:siemens:nucleus_rtos:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Wind River VxWorks",
            "product": {
              "name": "Wind River VxWorks",
              "product_id": "T018911",
              "product_identification_helper": {
                "cpe": "cpe:/o:windriver:vxworks:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Wind River"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2016-20009",
      "notes": [
        {
          "category": "description",
          "text": "In der DNS-Implementierung in weitgenutzten TCP/IP Stacks bestehen mehrere Schwachstellen, die sich in Server-Anwendungen, aber auch IoT und OT-Devices befinden. Sie basieren gr\u00f6\u00dftenteils auf Fehlern in der Kompressionsfunktion der DNS-Implementierung. Ein entfernter anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code mit Administratorrechten zur Ausf\u00fchrung zu bringen oder einen Denial of Service zu verursachen."
        }
      ],
      "product_status": {
        "known_affected": [
          "683157",
          "T018910",
          "T018911",
          "683163"
        ]
      },
      "release_date": "2021-04-15T22:00:00.000+00:00",
      "title": "CVE-2016-20009"
    },
    {
      "cve": "CVE-2020-15795",
      "notes": [
        {
          "category": "description",
          "text": "In der DNS-Implementierung in weitgenutzten TCP/IP Stacks bestehen mehrere Schwachstellen, die sich in Server-Anwendungen, aber auch IoT und OT-Devices befinden. Sie basieren gr\u00f6\u00dftenteils auf Fehlern in der Kompressionsfunktion der DNS-Implementierung. Ein entfernter anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code mit Administratorrechten zur Ausf\u00fchrung zu bringen oder einen Denial of Service zu verursachen."
        }
      ],
      "product_status": {
        "known_affected": [
          "683157",
          "T018910",
          "T018911",
          "683163"
        ]
      },
      "release_date": "2021-04-15T22:00:00.000+00:00",
      "title": "CVE-2020-15795"
    },
    {
      "cve": "CVE-2020-27009",
      "notes": [
        {
          "category": "description",
          "text": "In der DNS-Implementierung in weitgenutzten TCP/IP Stacks bestehen mehrere Schwachstellen, die sich in Server-Anwendungen, aber auch IoT und OT-Devices befinden. Sie basieren gr\u00f6\u00dftenteils auf Fehlern in der Kompressionsfunktion der DNS-Implementierung. Ein entfernter anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code mit Administratorrechten zur Ausf\u00fchrung zu bringen oder einen Denial of Service zu verursachen."
        }
      ],
      "product_status": {
        "known_affected": [
          "683157",
          "T018910",
          "T018911",
          "683163"
        ]
      },
      "release_date": "2021-04-15T22:00:00.000+00:00",
      "title": "CVE-2020-27009"
    },
    {
      "cve": "CVE-2020-27736",
      "notes": [
        {
          "category": "description",
          "text": "In der DNS-Implementierung in weitgenutzten TCP/IP Stacks bestehen mehrere Schwachstellen, die sich in Server-Anwendungen, aber auch IoT und OT-Devices befinden. Sie basieren gr\u00f6\u00dftenteils auf Fehlern in der Kompressionsfunktion der DNS-Implementierung. Ein entfernter anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code mit Administratorrechten zur Ausf\u00fchrung zu bringen oder einen Denial of Service zu verursachen."
        }
      ],
      "product_status": {
        "known_affected": [
          "683157",
          "T018910",
          "T018911",
          "683163"
        ]
      },
      "release_date": "2021-04-15T22:00:00.000+00:00",
      "title": "CVE-2020-27736"
    },
    {
      "cve": "CVE-2020-27737",
      "notes": [
        {
          "category": "description",
          "text": "In der DNS-Implementierung in weitgenutzten TCP/IP Stacks bestehen mehrere Schwachstellen, die sich in Server-Anwendungen, aber auch IoT und OT-Devices befinden. Sie basieren gr\u00f6\u00dftenteils auf Fehlern in der Kompressionsfunktion der DNS-Implementierung. Ein entfernter anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code mit Administratorrechten zur Ausf\u00fchrung zu bringen oder einen Denial of Service zu verursachen."
        }
      ],
      "product_status": {
        "known_affected": [
          "683157",
          "T018910",
          "T018911",
          "683163"
        ]
      },
      "release_date": "2021-04-15T22:00:00.000+00:00",
      "title": "CVE-2020-27737"
    },
    {
      "cve": "CVE-2020-27738",
      "notes": [
        {
          "category": "description",
          "text": "In der DNS-Implementierung in weitgenutzten TCP/IP Stacks bestehen mehrere Schwachstellen, die sich in Server-Anwendungen, aber auch IoT und OT-Devices befinden. Sie basieren gr\u00f6\u00dftenteils auf Fehlern in der Kompressionsfunktion der DNS-Implementierung. Ein entfernter anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code mit Administratorrechten zur Ausf\u00fchrung zu bringen oder einen Denial of Service zu verursachen."
        }
      ],
      "product_status": {
        "known_affected": [
          "683157",
          "T018910",
          "T018911",
          "683163"
        ]
      },
      "release_date": "2021-04-15T22:00:00.000+00:00",
      "title": "CVE-2020-27738"
    },
    {
      "cve": "CVE-2021-25663",
      "notes": [
        {
          "category": "description",
          "text": "In der DNS-Implementierung in weitgenutzten TCP/IP Stacks bestehen mehrere Schwachstellen, die sich in Server-Anwendungen, aber auch IoT und OT-Devices befinden. Sie basieren gr\u00f6\u00dftenteils auf Fehlern in der Kompressionsfunktion der DNS-Implementierung. Ein entfernter anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code mit Administratorrechten zur Ausf\u00fchrung zu bringen oder einen Denial of Service zu verursachen."
        }
      ],
      "product_status": {
        "known_affected": [
          "683157",
          "T018910",
          "T018911",
          "683163"
        ]
      },
      "release_date": "2021-04-15T22:00:00.000+00:00",
      "title": "CVE-2021-25663"
    },
    {
      "cve": "CVE-2021-25664",
      "notes": [
        {
          "category": "description",
          "text": "In der DNS-Implementierung in weitgenutzten TCP/IP Stacks bestehen mehrere Schwachstellen, die sich in Server-Anwendungen, aber auch IoT und OT-Devices befinden. Sie basieren gr\u00f6\u00dftenteils auf Fehlern in der Kompressionsfunktion der DNS-Implementierung. Ein entfernter anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code mit Administratorrechten zur Ausf\u00fchrung zu bringen oder einen Denial of Service zu verursachen."
        }
      ],
      "product_status": {
        "known_affected": [
          "683157",
          "T018910",
          "T018911",
          "683163"
        ]
      },
      "release_date": "2021-04-15T22:00:00.000+00:00",
      "title": "CVE-2021-25664"
    },
    {
      "cve": "CVE-2021-25677",
      "notes": [
        {
          "category": "description",
          "text": "In der DNS-Implementierung in weitgenutzten TCP/IP Stacks bestehen mehrere Schwachstellen, die sich in Server-Anwendungen, aber auch IoT und OT-Devices befinden. Sie basieren gr\u00f6\u00dftenteils auf Fehlern in der Kompressionsfunktion der DNS-Implementierung. Ein entfernter anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code mit Administratorrechten zur Ausf\u00fchrung zu bringen oder einen Denial of Service zu verursachen."
        }
      ],
      "product_status": {
        "known_affected": [
          "683157",
          "T018910",
          "T018911",
          "683163"
        ]
      },
      "release_date": "2021-04-15T22:00:00.000+00:00",
      "title": "CVE-2021-25677"
    },
    {
      "cve": "CVE-2021-27393",
      "notes": [
        {
          "category": "description",
          "text": "In der DNS-Implementierung in weitgenutzten TCP/IP Stacks bestehen mehrere Schwachstellen, die sich in Server-Anwendungen, aber auch IoT und OT-Devices befinden. Sie basieren gr\u00f6\u00dftenteils auf Fehlern in der Kompressionsfunktion der DNS-Implementierung. Ein entfernter anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code mit Administratorrechten zur Ausf\u00fchrung zu bringen oder einen Denial of Service zu verursachen."
        }
      ],
      "product_status": {
        "known_affected": [
          "683157",
          "T018910",
          "T018911",
          "683163"
        ]
      },
      "release_date": "2021-04-15T22:00:00.000+00:00",
      "title": "CVE-2021-27393"
    }
  ]
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202104-1825",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "nucleus readystart v3",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "2017.02.3"
      },
      {
        "model": "nucleus source code",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "siemens",
        "version": null
      },
      {
        "model": "simotics connect 400",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "0.5.0.0"
      },
      {
        "model": "nucleus net",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "*"
      },
      {
        "model": "nucleus readystart v4",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "4.1.0"
      },
      {
        "model": "simotics connect",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "siemens",
        "version": "400\u003cv0.5.0.0"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2021-28706"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-27737"
      }
    ]
  },
  "cve": "CVE-2020-27737",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.6,
            "id": "CVE-2020-27737",
            "impactScore": 4.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 1.1,
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "CNVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 6.1,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 4.9,
            "id": "CNVD-2021-28706",
            "impactScore": 7.8,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 0.6,
            "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:C",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "exploitabilityScore": 2.2,
            "id": "CVE-2020-27737",
            "impactScore": 4.2,
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 2.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2020-27737",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "productcert@siemens.com",
            "id": "CVE-2020-27737",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2021-28706",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202104-975",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202104-938",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "VULMON",
            "id": "CVE-2020-27737",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2021-28706"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-27737"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-975"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-938"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-27737"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-27737"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions \u003c V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions \u003c V2.8.20), APOGEE PXC Modular (BACnet) (All versions \u003c V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions \u003c V2.8.20), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions \u003c V2017.02.3), Nucleus ReadyStart V4 (All versions \u003c V4.1.0), Nucleus Source Code (Versions including affected DNS modules), SIMOTICS CONNECT 400 (All versions \u003c V0.5.0.0), TALON TC Compact (BACnet) (All versions \u003c V3.5.5), TALON TC Modular (BACnet) (All versions \u003c V3.5.5). The DNS response parsing functionality does not properly validate various length and counts of the records. The parsing of malformed responses could result in a read past the end of an allocated structure. An attacker with a privileged position in the network could leverage this vulnerability to cause a denial-of-service condition  or leak the memory past the allocated structure. SIMOTICS CONNECT 400 is a connector and sensor box installed on a low-voltage motor and provides analysis data for the MindSphere application SIDRIVE IQ Fleet. \n\r\n\r\nSiemens SIMOTICS CONNECT 400 has an out-of-bounds read vulnerability. Pillow is a Python-based image processing library. \nThere is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2020-27737"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2021-28706"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-975"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-27737"
      }
    ],
    "trust": 2.07
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2020-27737",
        "trust": 2.3
      },
      {
        "db": "SIEMENS",
        "id": "SSA-669158",
        "trust": 2.3
      },
      {
        "db": "SIEMENS",
        "id": "SSA-705111",
        "trust": 1.7
      },
      {
        "db": "SIEMENS",
        "id": "SSA-180579",
        "trust": 1.0
      },
      {
        "db": "CNVD",
        "id": "CNVD-2021-28706",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2021041363",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-975",
        "trust": 0.6
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-21-103-13",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2021041407",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2021041515",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-938",
        "trust": 0.6
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-27737",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2021-28706"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-27737"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-975"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-938"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-27737"
      }
    ]
  },
  "id": "VAR-202104-1825",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2021-28706"
      }
    ],
    "trust": 1.1595598933333333
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "Network device"
        ],
        "sub_category": null,
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2021-28706"
      }
    ]
  },
  "last_update_date": "2024-11-23T20:59:06.066000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Patch for Siemens SIMOTICS CONNECT 400 out-of-bounds read vulnerability",
        "trust": 0.6,
        "url": "https://www.cnvd.org.cn/patchInfo/show/258571"
      },
      {
        "title": "Siemens Security Advisories: Siemens Security Advisory",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=siemens_security_advisories\u0026qid=53e7f522de1910b1af8f6f92fe53b3b1"
      },
      {
        "title": "Siemens Security Advisories: Siemens Security Advisory",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=siemens_security_advisories\u0026qid=8f932b97a970d1020015c1a82a730e96"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2021-28706"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-27737"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-125",
        "trust": 1.0
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2020-27737"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.3,
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-669158.pdf"
      },
      {
        "trust": 1.7,
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-705111.pdf"
      },
      {
        "trust": 1.0,
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-180579.pdf"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2021041363"
      },
      {
        "trust": 0.6,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-27737"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2021041515"
      },
      {
        "trust": 0.6,
        "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-103-13"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2021041407"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/125.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-669158.txt"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2021-28706"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-27737"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-975"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-938"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-27737"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "CNVD",
        "id": "CNVD-2021-28706"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-27737"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-975"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-938"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-27737"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2021-04-15T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2021-28706"
      },
      {
        "date": "2021-04-22T00:00:00",
        "db": "VULMON",
        "id": "CVE-2020-27737"
      },
      {
        "date": "2021-04-13T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202104-975"
      },
      {
        "date": "2021-04-13T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202104-938"
      },
      {
        "date": "2021-04-22T21:15:09.280000",
        "db": "NVD",
        "id": "CVE-2020-27737"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2021-04-15T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2021-28706"
      },
      {
        "date": "2021-04-30T00:00:00",
        "db": "VULMON",
        "id": "CVE-2020-27737"
      },
      {
        "date": "2021-04-14T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202104-975"
      },
      {
        "date": "2022-03-11T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202104-938"
      },
      {
        "date": "2024-11-21T05:21:43.447000",
        "db": "NVD",
        "id": "CVE-2020-27737"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-938"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Siemens SIMOTICS CONNECT 400 out-of-bounds read vulnerability",
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2021-28706"
      }
    ],
    "trust": 0.6
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "other",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-975"
      }
    ],
    "trust": 0.6
  }
}

{
  "GSD": {
    "alias": "CVE-2020-27737",
    "description": "A vulnerability has been identified in Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions \u003c V2017.02.3), Nucleus ReadyStart V4 (All versions \u003c V4.1.0), Nucleus Source Code (Versions including affected DNS modules), SIMOTICS CONNECT 400 (All versions \u003c V0.5.0.0). The DNS response parsing functionality does not properly validate various length and counts of the records. The parsing of malformed responses could result in a read past the end of an allocated structure. An attacker with a privileged position in the network could leverage this vulnerability to cause a denial-of-service condition or leak the memory past the allocated structure.",
    "id": "GSD-2020-27737"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2020-27737"
      ],
      "details": "A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions \u003c V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions \u003c V2.8.20), APOGEE PXC Modular (BACnet) (All versions \u003c V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions \u003c V2.8.20), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions \u003c V2017.02.3), Nucleus ReadyStart V4 (All versions \u003c V4.1.0), Nucleus Source Code (Versions including affected DNS modules), SIMOTICS CONNECT 400 (All versions \u003c V0.5.0.0), TALON TC Compact (BACnet) (All versions \u003c V3.5.5), TALON TC Modular (BACnet) (All versions \u003c V3.5.5). The DNS response parsing functionality does not properly validate various length and counts of the records. The parsing of malformed responses could result in a read past the end of an allocated structure. An attacker with a privileged position in the network could leverage this vulnerability to cause a denial-of-service condition  or leak the memory past the allocated structure.",
      "id": "GSD-2020-27737",
      "modified": "2023-12-13T01:22:11.422881Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "productcert@siemens.com",
        "ID": "CVE-2020-27737",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "APOGEE PXC Compact (BACnet)",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "All versions \u003c V3.5.5"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "APOGEE PXC Compact (P2 Ethernet)",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "All versions \u003c V2.8.20"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "APOGEE PXC Modular (BACnet)",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "All versions \u003c V3.5.5"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "APOGEE PXC Modular (P2 Ethernet)",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "All versions \u003c V2.8.20"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Nucleus NET",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "All versions"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Nucleus ReadyStart V3",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "All versions \u003c V2017.02.3"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Nucleus ReadyStart V4",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "All versions \u003c V4.1.0"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Nucleus Source Code",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "Versions including affected DNS modules"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "SIMOTICS CONNECT 400",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "All versions \u003c V0.5.0.0"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "TALON TC Compact (BACnet)",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "All versions \u003c V3.5.5"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "TALON TC Modular (BACnet)",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "All versions \u003c V3.5.5"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Siemens"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions \u003c V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions \u003c V2.8.20), APOGEE PXC Modular (BACnet) (All versions \u003c V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions \u003c V2.8.20), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions \u003c V2017.02.3), Nucleus ReadyStart V4 (All versions \u003c V4.1.0), Nucleus Source Code (Versions including affected DNS modules), SIMOTICS CONNECT 400 (All versions \u003c V0.5.0.0), TALON TC Compact (BACnet) (All versions \u003c V3.5.5), TALON TC Modular (BACnet) (All versions \u003c V3.5.5). The DNS response parsing functionality does not properly validate various length and counts of the records. The parsing of malformed responses could result in a read past the end of an allocated structure. An attacker with a privileged position in the network could leverage this vulnerability to cause a denial-of-service condition  or leak the memory past the allocated structure."
          }
        ]
      },
      "impact": {
        "cvss": [
          {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-125",
                "lang": "eng",
                "value": "CWE-125: Out-of-bounds Read"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-705111.pdf",
            "refsource": "MISC",
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-705111.pdf"
          },
          {
            "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-669158.pdf",
            "refsource": "MISC",
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-669158.pdf"
          },
          {
            "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-180579.pdf",
            "refsource": "MISC",
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-180579.pdf"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:siemens:simotics_connect_400_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "0.5.0.0",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:siemens:simotics_connect_400:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:siemens:nucleus_net:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:siemens:nucleus_source_code:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:siemens:nucleus_readystart_v3:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2017.02.3",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:siemens:nucleus_readystart_v4:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "4.1.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "productcert@siemens.com",
          "ID": "CVE-2020-27737"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions \u003c V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions \u003c V2.8.20), APOGEE PXC Modular (BACnet) (All versions \u003c V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions \u003c V2.8.20), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions \u003c V2017.02.3), Nucleus ReadyStart V4 (All versions \u003c V4.1.0), Nucleus Source Code (Versions including affected DNS modules), SIMOTICS CONNECT 400 (All versions \u003c V0.5.0.0), TALON TC Compact (BACnet) (All versions \u003c V3.5.5), TALON TC Modular (BACnet) (All versions \u003c V3.5.5). The DNS response parsing functionality does not properly validate various length and counts of the records. The parsing of malformed responses could result in a read past the end of an allocated structure. An attacker with a privileged position in the network could leverage this vulnerability to cause a denial-of-service condition  or leak the memory past the allocated structure."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-125"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-705111.pdf",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-705111.pdf"
            },
            {
              "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-669158.pdf",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-669158.pdf"
            },
            {
              "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-180579.pdf",
              "refsource": "MISC",
              "tags": [],
              "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-180579.pdf"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 8.6,
          "impactScore": 4.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 2.2,
          "impactScore": 4.2
        }
      },
      "lastModifiedDate": "2023-08-08T10:15Z",
      "publishedDate": "2021-04-22T21:15Z"
    }
  }
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-27737"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-04-22T21:15:00Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability has been identified in Nucleus 4 (All versions \u003c V4.1.0), Nucleus NET (All versions), Nucleus RTOS (versions including affected DNS modules), Nucleus ReadyStart (All versions \u003c V2017.02.3), Nucleus Source Code (versions including affected DNS modules), SIMOTICS CONNECT 400 (All versions \u003c V0.5.0.0), VSTAR (versions including affected DNS modules). The DNS response parsing functionality does not properly validate various length and counts of the records. The parsing of malformed responses could result in a read past the end of an allocated structure. An attacker with a privileged position in the network could leverage this vulnerability to cause a denial-of-service condition or leak the memory past the allocated structure.",
  "id": "GHSA-j94w-w786-mv9m",
  "modified": "2022-05-24T17:48:18Z",
  "published": "2022-05-24T17:48:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-27737"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-180579.pdf"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-669158.pdf"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-705111.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}