Unscored severity · published Aug 4, 2015
CVE-2015-3963
Wind River VxWorks before 5.5.1, 6.5.x through 6.7.x before 6.7.1.1, 6.8.x before 6.8.3, 6.9.x before 6.9.4.4, and 7.x before 7 ipnet_coreip 1.2.2.0, as used on Schneider Electric…
–
CVSS
3.7%
EPSS
No
On KEV
Description
Wind River VxWorks before 5.5.1, 6.5.x through 6.7.x before 6.7.1.1, 6.8.x before 6.8.3, 6.9.x before 6.9.4.4, and 7.x before 7 ipnet_coreip 1.2.2.0, as used on Schneider Electric SAGE RTU devices before J2 and other devices, does not properly generate TCP initial sequence number (ISN) values, which makes it easier for remote attackers to spoof TCP sessions by predicting an ISN value.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.7% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VX
Vxworks · Windriver
6.5 through 6.6; 6.7 before 6.7.1.1; 6.8 before 6.8.3; 6.9 before 6.9.4.4; 6.6.3; 6.6.4; +2 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-3963
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-3963
Patch
http://www.schneider-electric.com/ww/en/download/document/SEVD-2015-162-01
Third Party Advisory
http://www.securityfocus.com/bid/75302
Third Party Advisory
http://www.securitytracker.com/id/1032730
Third Party Advisory
http://www.securitytracker.com/id/1033181
Third Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-15-169-01
Third Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-15-169-01A
More from Vxworks
9.8
CVE-2020-35198
An issue was discovered in Wind River VxWorks 7
9.8
CVE-2021-29999
An issue was discovered in Wind River VxWorks through 6.8
9.8
CVE-2021-29998
An issue was discovered in Wind River VxWorks before 6.5
9.8
CVE-2016-20009
A DNS client stack-based buffer overflow in ipdnsc_decode_name() affects Wind River VxWorks 6.5 through 7
9.8
CVE-2019-12262
Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and 7 has Incorrect Access Control in the RARP client component