OpenCVE

In SIMATIC MV400 family versions prior to v7.0.6, the ISN generator is initialized with a constant value and has constant increments. An attacker could predict and hijack TCP sessions.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

AV:N/AC:L/Au:N/C:N/I:P/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Siemens	Simatic Mv420 Simatic Mv420 Firmware Simatic Mv440 Simatic Mv440 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:siemens:simatic_mv420_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:siemens:simatic_mv420:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:siemens:simatic_mv440_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:siemens:simatic_mv440:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://cert-portal.siemens.com/productcert/pdf/ssa-599268.pdf
https://www.cisa.gov/news-events/ics-advisories/icsa-21-042-01
https://www.forescout.com/resources/numberjack-weak-isn-generation-in-embedded-tcpip-stacks/

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2021-03-10T00:00:00

Updated: 2024-08-04T16:18:45.486Z

Reserved: 2020-10-22T00:00:00

Link: CVE-2020-27632

Vulnrichment

No data.

NVD

Status : Modified

Published: 2021-03-10T18:15:12.797

Modified: 2024-11-21T05:21:32.823

Link: CVE-2020-27632

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:siemens:simatic_mv420_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "AA65BD0C-3249-4AB6-A066-C55ADC06EDB7", "versionEndExcluding": "7.0.6", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:siemens:simatic_mv420:-:*:*:*:*:*:*:*", "matchCriteriaId": "79B15C1B-2510-434B-A589-5903CA0C00EE", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:siemens:simatic_mv440_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "2FCC833E-AA77-471E-87CA-40B5E354163F", "versionEndExcluding": "7.0.6", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:siemens:simatic_mv440:-:*:*:*:*:*:*:*", "matchCriteriaId": "6408042E-7E06-4AED-9853-29B176EDFE9F", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "In SIMATIC MV400 family versions prior to v7.0.6, the ISN generator is initialized with a constant value and has constant increments. An attacker could predict and hijack TCP sessions."}, {"lang": "es", "value": "En la familia SIMATIC MV400 versiones anteriores a la v7.0.6, el generador ISN es inicializado con un valor constante y presenta incrementos constantes. Un atacante podr\u00eda predecir y secuestrar sesiones de TCP"}], "id": "CVE-2020-27632", "lastModified": "2024-11-21T05:21:32.823", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-03-10T18:15:12.797", "references": [{"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-599268.pdf"}, {"source": "cve@mitre.org", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-042-01"}, {"source": "cve@mitre.org", "url": "https://www.forescout.com/resources/numberjack-weak-isn-generation-in-embedded-tcpip-stacks/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-599268.pdf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-042-01"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.forescout.com/resources/numberjack-weak-isn-generation-in-embedded-tcpip-stacks/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}