CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:C/I:N/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
78.5%
CISA is aware of a public report, known as โINFRA:HALTโ that details vulnerabilities found in the HCC Embedded InterNiche TCP/IP stack, previously known as InterNiche NicheStack. CISA is issuing this advisory to provide early notice of the reported vulnerabilities and identify baseline mitigations for reducing risks to these and other cybersecurity attacks.
This updated advisory is a follow-up to the advisory update titled ICSA-21-217-01 HCC Embedded InterNiche TCP/IP stack NicheLite (Update A) that was published September 14, 2021, to the ICS webpage at www.cisa.gov/uscert.
Successful exploitation of these vulnerabilities may result in unauthorized access to arbitrary information, DNS cache poisoning, remote code execution, or a denial-of-service condition.
The following embedded component TCP/IP stacks are affected:
When parsing DNS domain names, there are no checks on whether a domain name compression pointer is pointing within the bounds of the packet, which may result in an out-of-bounds read.
CVE-2020-25767 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
The routine for parsing DNS response packets does not check the โresponse data lengthโ field of individual DNS answers, which may cause an out-of-bounds read/write.
CVE-2020-25928 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
The number of queries or responses specified in the DNS packet header is not validated with the query/response data available in the DNS packet, leading to an out-of-bounds read.
CVE-2020-25927 has been assigned to this vulnerability. A CVSS v3 base score of 8.2 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H).
The DNS client does not sufficiently randomize transaction IDs, facilitating DNS cache poisoning attacks.
CVE-2020-25926 has been assigned to this vulnerability. A CVSS v3 base score of 4.0 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N).
The code that parses ICMP packets relies on an unchecked value of the IP payload size to compute the ICMP checksum, which may result in an out-of-bounds read.
CVE-2020-35683 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
The code that parses TCP packets relies on an unchecked value of the IP payload size to compute the length of the TCP payload within the TCP checksum computation function, which may result in an out-of-bounds read.
CVE-2020-35684 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
TCP ISNs are insufficiently randomized, which may result in TCP spoofing by an attacker.
CVE-2020-35685 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
The TCP urgent data processing function may invoke a panic function, which may result in an infinite loop.
CVE-2021-31400 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
An attacker could send a specially crafted IP packet to trigger an integer overflow due to the lack of IP length validation.
CVE-2021-31401 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
A potential heap buffer overflow exists in the code that parses the HTTP POST request due to lack of size validation.
CVE-2021-31226 has been assigned to this vulnerability. A CVSS v3 base score of 9.1 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).
A potential heap buffer overflow exists in the code that parses the HTTP POST request due to an incorrect signed integer comparison.
CVE-2021-31227 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
An attacker may be able to predict DNS queriesโ source port to then send forged DNS response packets, which may be accepted as valid answers.
CVE-2021-31228 has been assigned to this vulnerability. A CVSS v3 base score of 4.0 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N).
Unhandled HTTP requests result in an infinite loop that disrupts TCP/IP communication.
CVE-2021-27565 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
The TFTP packet processing function does not ensure that the filename is null-terminated, which may result in a denial-of-service condition.
CVE-2021-36762 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
Amine Amri, Stanislav Dashevskyi, and Daniel dos Santos from Forescout, and Asaf Karas and Shachar Menashe from VDOO reported these vulnerabilities to CISA.
HCC recommends users apply release v4.3 or later to mitigate these vulnerabilities. For more information, contact HCC.
Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:
--------- Begin Update B Part 1 of 1 ---------
--------- End Update B Part 1 of 1 ---------
CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Specifically, users should:
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.
No known public exploits specifically target these vulnerabilities.
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-25767
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-25926
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-25927
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-25928
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-35683
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-35684
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-35685
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-27565
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-31226
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-31227
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-31228
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-31400
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-31401
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-36762
cert-portal.siemens.com/productcert/pdf/ssa-789208.pdf
cisasurvey.gov1.qualtrics.com/jfe/form/SV_9n4TtB8uttUPaM6?product=https://www.cisa.gov/news-events/ics-advisories/icsa-21-217-01
cwe.mitre.org/data/definitions/130.html
cwe.mitre.org/data/definitions/130.html
cwe.mitre.org/data/definitions/170.html
cwe.mitre.org/data/definitions/20.html
cwe.mitre.org/data/definitions/20.html
cwe.mitre.org/data/definitions/20.html
cwe.mitre.org/data/definitions/20.html
cwe.mitre.org/data/definitions/248.html
cwe.mitre.org/data/definitions/330.html
cwe.mitre.org/data/definitions/330.html
cwe.mitre.org/data/definitions/340.html
cwe.mitre.org/data/definitions/466.html
cwe.mitre.org/data/definitions/703.html
cwe.mitre.org/data/definitions/839.html
public.govdelivery.com/accounts/USDHSCISA/subscriber/new?topic_id=USDHSCISA_138
twitter.com/CISAgov
twitter.com/intent/tweet?text=HCC%20Embedded%20InterNiche%20TCP/IP%20stack%2C%20NicheLite%20%28Update%20B%29+https://www.cisa.gov/news-events/ics-advisories/icsa-21-217-01
us-cert.cisa.gov/ics/alerts/ICS-ALERT-10-301-01
www.cisa.gov/uscert/ics
www.cisa.gov/uscert/ics/recommended-practices
www.cisa.gov/uscert/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
www.dhs.gov
www.dhs.gov/foia
www.dhs.gov/performance-financial-reports
www.facebook.com/CISA
www.facebook.com/sharer/sharer.php?u=https://www.cisa.gov/news-events/ics-advisories/icsa-21-217-01&title=HCC%20Embedded%20InterNiche%20TCP/IP%20stack%2C%20NicheLite%20%28Update%20B%29
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
www.instagram.com/cisagov
www.linkedin.com/company/cybersecurity-and-infrastructure-security-agency
www.linkedin.com/sharing/share-offsite/?url=https://www.cisa.gov/news-events/ics-advisories/icsa-21-217-01
www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-022_en.pdf
www.oig.dhs.gov/
www.usa.gov/
www.whitehouse.gov/
www.youtube.com/@cisagov
mailto:?subject=HCC%20Embedded%20InterNiche%20TCP/IP%20stack%2C%20NicheLite%20%28Update%20B%29&body=www.cisa.gov/news-events/ics-advisories/icsa-21-217-01
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:C/I:N/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
78.5%