5.3

CVE-2020-28388

A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (All versions < V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.20), Nucleus NET (All versions < V5.2), Nucleus ReadyStart V3 (All versions < V2012.12), Nucleus Source Code (All versions), PLUSCONTROL 1st Gen (All versions), TALON TC Compact (BACnet) (All versions < V3.5.5), TALON TC Modular (BACnet) (All versions < V3.5.5). Initial Sequence Numbers (ISNs) for TCP connections are derived from an insufficiently random source. As a result, the ISN of current and future TCP connections could be predictable. An attacker could hijack existing sessions or spoof future ones.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Siemens ≫ Nucleus Net Version < 5.2
Siemens ≫ Nucleus Readystart Version < 2012.12
   Arm ≫ Arm Version -
   Mips ≫ Mips Version -
   Powerpc Project ≫ Powerpc Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.35% 0.689
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
NIST 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:P/A:N
Siemens 6.5 3.9 2.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CWE-342 Predictable Exact Value from Previous Values

An exact value or random number can be precisely predicted by observing previous values.

https://cert-portal.siemens.com/productcert/pdf/ssa-180579.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-344238.pdf
Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-362164.pdf
Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-436469.pdf