← Back

CVE-2020-35685

nvd nist
Published: Aug 19, 2021Modified: Jun 17, 2026

JSON object

Loading...
9.1
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Exploitability: 3.9 / Impact: 5.2
Source: NVD

Description

An issue was discovered in HCC Nichestack 3.0. The code that generates Initial Sequence Numbers (ISNs) for TCP connections derives the ISN from an insufficiently random source. As a result, an attacker may be able to determine the ISN of current and future TCP connections and either hijack existing ones or spoof future ones. (Proper ISN generation should aim to follow at least the specifications outlined in RFC 6528.)

Affected (3)

Hcc Embedded
1 product
Nichestack
Siemens
2 products
Sentron 3wa Com190 Firmware
Sentron 3wl Com35 Firmware
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Nichestack
Version 3.0
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Sentron 3wa Com190 Firmware
Before 2.0.0
Running on/withPlatform Versions
Siemens
Sentron 3wa Com190
All versions
Configuration C
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Sentron 3wl Com35 Firmware
Before 1.2.0
Running on/withPlatform Versions
Siemens
Sentron 3wl Com35
All versions

Related CWEs

CWE-330
Use of Insufficiently Random Values
The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

References (8)

Source: cve@mitre.org
MitigationThird Party Advisory
Source: cve@mitre.org
MitigationThird Party Advisory
Source: cve@mitre.org
Product
Source: cve@mitre.org
Third Party AdvisoryUS Government Resource
Source: af854a3a-2127-422b-91ae-364da2661108
MitigationThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
MitigationThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Product
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryUS Government Resource

Timeline

No history available yet.