Lucene search

SiemensCVE-2020-27736

HistoryApr 22, 2021 - 9:15 p.m.

CVE-2020-27736

2021-04-2221:15:09

CWE-125

CWE-170

siemens

web.nvd.nist.gov

cve-2020-27736

vulnerability

apogee pxc

nucleus

simotics connect

talon tc

dns

dos

memory leak

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:N/A:P

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H

AI Score

6.6

Confidence

High

EPSS

0.002

Percentile

53.5%

JSON

A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (All versions < V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.20), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.3), Nucleus ReadyStart V4 (All versions < V4.1.0), Nucleus Source Code (Versions including affected DNS modules), SIMOTICS CONNECT 400 (All versions < V0.5.0.0), TALON TC Compact (BACnet) (All versions < V3.5.5), TALON TC Modular (BACnet) (All versions < V3.5.5). The DNS domain name label parsing functionality does not properly validate the null-terminated name in DNS-responses. The parsing of malformed responses could result in a read past the end of an allocated structure. An attacker with a privileged position in the network could leverage this vulnerability to cause a denial-of-service condition or leak the read memory.

Affected configurations

Nvd

Node

siemensnucleus_net

siemensnucleus_readystart_v3Range<2017.02.3

siemensnucleus_readystart_v4Range<4.1.0

siemensnucleus_source_codeMatch-

Node

siemenssimotics_connect_400_firmwareRange<0.5.0.0

AND

siemenssimotics_connect_400Match-

VendorProductVersionCPE
siemensnucleus_net*cpe:2.3:a:siemens:nucleus_net:*:*:*:*:*:*:*:*
siemensnucleus_readystart_v3*cpe:2.3:a:siemens:nucleus_readystart_v3:*:*:*:*:*:*:*:*
siemensnucleus_readystart_v4*cpe:2.3:a:siemens:nucleus_readystart_v4:*:*:*:*:*:*:*:*
siemensnucleus_source_code-cpe:2.3:a:siemens:nucleus_source_code:-:*:*:*:*:*:*:*
siemenssimotics_connect_400_firmware*cpe:2.3:o:siemens:simotics_connect_400_firmware:*:*:*:*:*:*:*:*
siemenssimotics_connect_400-cpe:2.3:h:siemens:simotics_connect_400:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
siemens	nucleus_net	*	cpe:2.3:a:siemens:nucleus_net::::::::
siemens	nucleus_readystart_v3	*	cpe:2.3:a:siemens:nucleus_readystart_v3::::::::
siemens	nucleus_readystart_v4	*	cpe:2.3:a:siemens:nucleus_readystart_v4::::::::
siemens	nucleus_source_code	-	cpe:2.3:a:siemens:nucleus_source_code:-:::::::*
siemens	simotics_connect_400_firmware	*	cpe:2.3:o:siemens:simotics_connect_400_firmware::::::::
siemens	simotics_connect_400	-	cpe:2.3:h:siemens:simotics_connect_400:-:::::::*

CNA Affected

[
  {
    "vendor": "Siemens",
    "product": "APOGEE PXC Compact (BACnet)",
    "versions": [
      {
        "version": "All versions < V3.5.5",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "Siemens",
    "product": "APOGEE PXC Compact (P2 Ethernet)",
    "versions": [
      {
        "version": "All versions < V2.8.20",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "Siemens",
    "product": "APOGEE PXC Modular (BACnet)",
    "versions": [
      {
        "version": "All versions < V3.5.5",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "Siemens",
    "product": "APOGEE PXC Modular (P2 Ethernet)",
    "versions": [
      {
        "version": "All versions < V2.8.20",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "Siemens",
    "product": "Nucleus NET",
    "versions": [
      {
        "version": "All versions",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "Siemens",
    "product": "Nucleus ReadyStart V3",
    "versions": [
      {
        "version": "All versions < V2017.02.3",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "Siemens",
    "product": "Nucleus ReadyStart V4",
    "versions": [
      {
        "version": "All versions < V4.1.0",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "Siemens",
    "product": "Nucleus Source Code",
    "versions": [
      {
        "version": "Versions including affected DNS modules",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "Siemens",
    "product": "SIMOTICS CONNECT 400",
    "versions": [
      {
        "version": "All versions < V0.5.0.0",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "Siemens",
    "product": "TALON TC Compact (BACnet)",
    "versions": [
      {
        "version": "All versions < V3.5.5",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "Siemens",
    "product": "TALON TC Modular (BACnet)",
    "versions": [
      {
        "version": "All versions < V3.5.5",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  }
]

References

cert-portal.siemens.com/productcert/pdf/ssa-180579.pdf

cert-portal.siemens.com/productcert/pdf/ssa-669158.pdf

cert-portal.siemens.com/productcert/pdf/ssa-705111.pdf

Social References

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:N/A:P

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H

AI Score

6.6

Confidence

High

EPSS

0.002

Percentile

53.5%

JSON

Related for CVE-2020-27736