{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
      "tlp": {
        "label": "WHITE"
      }
    },
    "notes": [
      {
        "category": "summary",
        "text": "A TCP sequence vulnerability in the APOGEE PXC and TALON TC series of products could allow an attacker to execute a denial of service attack by sending specially crafted packets to the device.\n\nSiemens has released updates for the affected products and recommends to update to the latest versions.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure Siemens strongly recommends to protect network access to affected products with appropriate mechanisms. It is advised to follow recommended security practices in order to run the devices in a protected IT environment.",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "productcert@siemens.com",
      "name": "Siemens ProductCERT",
      "namespace": "https://www.siemens.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-436469: TCP Vulnerability in APOGEE/TALON Field Panels - PDF Version",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-436469.pdf"
      },
      {
        "category": "self",
        "summary": "SSA-436469: TCP Vulnerability in APOGEE/TALON Field Panels - TXT Version",
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-436469.txt"
      },
      {
        "category": "self",
        "summary": "SSA-436469: TCP Vulnerability in APOGEE/TALON Field Panels - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-436469.json"
      }
    ],
    "title": "SSA-436469: TCP Vulnerability in APOGEE/TALON Field Panels",
    "tracking": {
      "current_release_date": "2022-12-13T00:00:00Z",
      "generator": {
        "engine": {
          "name": "Siemens ProductCERT CSAF Generator",
          "version": "1"
        }
      },
      "id": "SSA-436469",
      "initial_release_date": "2022-12-13T00:00:00Z",
      "revision_history": [
        {
          "date": "2022-12-13T00:00:00Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c V3.5.5",
                "product": {
                  "name": "APOGEE PXC Series (BACnet)",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "APOGEE PXC Series (BACnet)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c V2.8.20",
                "product": {
                  "name": "APOGEE PXC Series (P2 Ethernet)",
                  "product_id": "2"
                }
              }
            ],
            "category": "product_name",
            "name": "APOGEE PXC Series (P2 Ethernet)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c V3.5.5",
                "product": {
                  "name": "TALON TC Series (BACnet)",
                  "product_id": "3"
                }
              }
            ],
            "category": "product_name",
            "name": "TALON TC Series (BACnet)"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-28388",
      "cwe": {
        "id": "CWE-342",
        "name": "Predictable Exact Value from Previous Values"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Initial Sequence Numbers (ISNs) for TCP connections are derived from an insufficiently random source. As a result, the ISN of current and future TCP connections could be predictable. An attacker could hijack existing sessions or spoof future ones.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V3.5.5 or later version",
          "product_ids": [
            "1",
            "3"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V2.8.20 or later version",
          "product_ids": [
            "2"
          ],
          "url": "https://partnerportal.extranet.dc.siemens.com/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3"
          ]
        }
      ],
      "title": "CVE-2020-28388"
    }
  ]
}