Vulnerability-Lookup

CNVD-2021-58799

Vulnerability from cnvd - Published: 2021-08-05

Title

Siemens Interniche IP堆栈低压设备存在未明漏洞

Description

SENTRON 3WA COM190是3WA断路器的附件模块，通过PROFINET IO和Modbus TCP提供连接。SENTRON 3WL COM35是3WL断路器的附件模块，通过PROFINET IO和Modbus TCP提供连接。SENTRON 7KM PAC Switched Ethernet PROFINET Expansion Module是一种插件设备，为7KM PAC32x0/4200和3VA COM100/800设备提供交换式以太网PROFINET V3连接。 Siemens Interniche IP堆栈低压设备存在安全漏洞。目前没有详细的漏洞细节提供。

Severity

高

Patch Name

Siemens Interniche IP堆栈低压设备存在未明漏洞的补丁

Patch Description

Formal description

用户可参考如下供应商提供的安全公告获得补丁信息： https://cert-portal.siemens.com/productcert/pdf/ssa-789208.pdf

Reference

https://cert-portal.siemens.com/productcert/pdf/ssa-789208.pdf

Impacted products

Name
['Siemens SENTRON 7KM PAC Switched Ethernet PROFINET Expansion Module < V3.0.4', 'Siemens SENTRON 3WL COM35 < V1.2.0', 'Siemens SENTRON 3WA COM190 < V2.0.0']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-35685"
    }
  },
  "description": "SENTRON 3WA COM190\u662f3WA\u65ad\u8def\u5668\u7684\u9644\u4ef6\u6a21\u5757\uff0c\u901a\u8fc7PROFINET IO\u548cModbus TCP\u63d0\u4f9b\u8fde\u63a5\u3002SENTRON 3WL COM35\u662f3WL\u65ad\u8def\u5668\u7684\u9644\u4ef6\u6a21\u5757\uff0c\u901a\u8fc7PROFINET IO\u548cModbus TCP\u63d0\u4f9b\u8fde\u63a5\u3002SENTRON 7KM PAC Switched Ethernet PROFINET Expansion Module\u662f\u4e00\u79cd\u63d2\u4ef6\u8bbe\u5907\uff0c\u4e3a7KM PAC32x0/4200\u548c3VA COM100/800\u8bbe\u5907\u63d0\u4f9b\u4ea4\u6362\u5f0f\u4ee5\u592a\u7f51PROFINET V3\u8fde\u63a5\u3002\n\nSiemens Interniche IP\u5806\u6808\u4f4e\u538b\u8bbe\u5907\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u7684\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002",
  "formalWay": "\u7528\u6237\u53ef\u53c2\u8003\u5982\u4e0b\u4f9b\u5e94\u5546\u63d0\u4f9b\u7684\u5b89\u5168\u516c\u544a\u83b7\u5f97\u8865\u4e01\u4fe1\u606f\uff1a\r\nhttps://cert-portal.siemens.com/productcert/pdf/ssa-789208.pdf",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-58799",
  "openTime": "2021-08-05",
  "patchDescription": "SENTRON 3WA COM190\u662f3WA\u65ad\u8def\u5668\u7684\u9644\u4ef6\u6a21\u5757\uff0c\u901a\u8fc7PROFINET IO\u548cModbus TCP\u63d0\u4f9b\u8fde\u63a5\u3002SENTRON 3WL COM35\u662f3WL\u65ad\u8def\u5668\u7684\u9644\u4ef6\u6a21\u5757\uff0c\u901a\u8fc7PROFINET IO\u548cModbus TCP\u63d0\u4f9b\u8fde\u63a5\u3002SENTRON 7KM PAC Switched Ethernet PROFINET Expansion Module\u662f\u4e00\u79cd\u63d2\u4ef6\u8bbe\u5907\uff0c\u4e3a7KM PAC32x0/4200\u548c3VA COM100/800\u8bbe\u5907\u63d0\u4f9b\u4ea4\u6362\u5f0f\u4ee5\u592a\u7f51PROFINET V3\u8fde\u63a5\u3002\r\n\r\nSiemens Interniche IP\u5806\u6808\u4f4e\u538b\u8bbe\u5907\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u7684\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Siemens Interniche IP\u5806\u6808\u4f4e\u538b\u8bbe\u5907\u5b58\u5728\u672a\u660e\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Siemens SENTRON 7KM PAC Switched Ethernet PROFINET Expansion Module \u003c V3.0.4",
      "Siemens SENTRON 3WL COM35 \u003c V1.2.0",
      "Siemens SENTRON 3WA COM190 \u003c V2.0.0"
    ]
  },
  "referenceLink": "https://cert-portal.siemens.com/productcert/pdf/ssa-789208.pdf",
  "serverity": "\u9ad8",
  "submitTime": "2021-08-05",
  "title": "Siemens Interniche IP\u5806\u6808\u4f4e\u538b\u8bbe\u5907\u5b58\u5728\u672a\u660e\u6f0f\u6d1e"
}

CVE-2020-35685 (GCVE-0-2020-35685)

Vulnerability from cvelistv5 – Published: 2021-08-19 11:21 – Updated: 2024-08-04 17:09

Summary

An issue was discovered in HCC Nichestack 3.0. The code that generates Initial Sequence Numbers (ISNs) for TCP connections derives the ISN from an insufficiently random source. As a result, an attacker may be able to determine the ISN of current and future TCP connections and either hijack existing ones or spoof future ones. (Proper ISN generation should aim to follow at least the specifications outlined in RFC 6528.)

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root Scorecard

References

4 references

URL	Tags
https://www.hcc-embedded.com	x_refsource_MISC
https://cert-portal.siemens.com/productcert/pdf/s…	x_refsource_CONFIRM
https://www.forescout.com/blog/new-critical-opera…	x_refsource_MISC
https://www.kb.cert.org/vuls/id/608209	third-party-advisoryx_refsource_CERT-VN

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T17:09:14.933Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.hcc-embedded.com"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-789208.pdf"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.forescout.com/blog/new-critical-operational-technology-vulnerabilities-found-on-nichestack/"
          },
          {
            "name": "VU#608209",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "https://www.kb.cert.org/vuls/id/608209"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in HCC Nichestack 3.0. The code that generates Initial Sequence Numbers (ISNs) for TCP connections derives the ISN from an insufficiently random source. As a result, an attacker may be able to determine the ISN of current and future TCP connections and either hijack existing ones or spoof future ones. (Proper ISN generation should aim to follow at least the specifications outlined in RFC 6528.)"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-08-19T11:21:29.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.hcc-embedded.com"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-789208.pdf"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.forescout.com/blog/new-critical-operational-technology-vulnerabilities-found-on-nichestack/"
        },
        {
          "name": "VU#608209",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "https://www.kb.cert.org/vuls/id/608209"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-35685",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An issue was discovered in HCC Nichestack 3.0. The code that generates Initial Sequence Numbers (ISNs) for TCP connections derives the ISN from an insufficiently random source. As a result, an attacker may be able to determine the ISN of current and future TCP connections and either hijack existing ones or spoof future ones. (Proper ISN generation should aim to follow at least the specifications outlined in RFC 6528.)"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.hcc-embedded.com",
              "refsource": "MISC",
              "url": "https://www.hcc-embedded.com"
            },
            {
              "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-789208.pdf",
              "refsource": "CONFIRM",
              "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-789208.pdf"
            },
            {
              "name": "https://www.forescout.com/blog/new-critical-operational-technology-vulnerabilities-found-on-nichestack/",
              "refsource": "MISC",
              "url": "https://www.forescout.com/blog/new-critical-operational-technology-vulnerabilities-found-on-nichestack/"
            },
            {
              "name": "VU#608209",
              "refsource": "CERT-VN",
              "url": "https://www.kb.cert.org/vuls/id/608209"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-35685",
    "datePublished": "2021-08-19T11:21:08.000Z",
    "dateReserved": "2020-12-24T00:00:00.000Z",
    "dateUpdated": "2024-08-04T17:09:14.933Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CNVD-2021-58799

CVE-2020-35685 (GCVE-0-2020-35685)

Tags

Sightings

Nomenclature

Related by attack behaviour