High severity · published Aug 19, 2021
CVE-2020-35683
An issue was discovered in HCC Nichestack 3.0
7.5
CVSS
2.3%
EPSS
No
On KEV
Description
An issue was discovered in HCC Nichestack 3.0. The code that parses ICMP packets relies on an unchecked value of the IP payload size (extracted from the IP header) to compute the ICMP checksum. When the IP payload size is set to be smaller than the size of the IP header, the ICMP checksum computation function may read out of bounds, causing a Denial-of-Service.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
7F
7km9300-0ae02-0aa0 Firmware · Siemens
before 3.0.4 · source: NVD
NI
Nichestack · Hcc-embedded
3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-35683
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-35683
Mitigation
https://cert-portal.siemens.com/productcert/pdf/ssa-789208.pdf
Mitigation
https://www.forescout.com/blog/new-critical-operational-technology-vulnerabilities-found-on-nichestack/
Product
https://www.hcc-embedded.com
Third Party Advisory
https://www.kb.cert.org/vuls/id/608209
More from Nichestack
9.1
CVE-2020-35685
An issue was discovered in HCC Nichestack 3.0
7.5
CVE-2021-36762
An issue was discovered in HCC Embedded InterNiche NicheStack through 4.3
7.5
CVE-2021-31401
An issue was discovered in tcp_rcv() in nptcp.c in HCC embedded InterNiche 4.0.1
7.5
CVE-2021-27565
The web server in InterNiche NicheStack through 4.0.1 allows remote attackers to cause a denial of service (infinite loop and networking outage) via an unexpected valid HTTP…
7.5
CVE-2020-35684
An issue was discovered in HCC Nichestack 3.0