PT-2021-2228 · Oryx · Cyclonetcp

Amine Amri + 3 · Published 2021-03-05 · Updated 2023-10-13 · CVE-2020-27631

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Oryx CycloneTCP version 1.9.6

Description The issue is related to the improper randomness of TCP Initial Sequence Numbers (ISNs) in the CycloneTCP stack implementation. This could allow a remote attacker to gain unauthorized access to protected information. The estimated number of potentially affected devices worldwide is not specified.

Recommendations For Oryx CycloneTCP version 1.9.6, consider updating to a newer version that properly randomizes TCP ISNs to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

Related Identifiers

BDU:2021-01173

CVE-2020-27631

Affected Products

Cyclonetcp

References · 13

• https://osv.dev/vulnerability/CVE-2020-27631 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-27631 · Security Note
• https://bdu.fstec.ru/vul/2021-01173 · Security Note
• https://github.com/Oryx-Embedded/CycloneTCP/tree/v2.0.0 · Note
• https://securitylab.ru/vulnerability/516444.php · Note
• https://cybersecurity-help.cz/vdb/SB2021021014 · Note
• https://cisa.gov/news-events/ics-advisories/icsa-21-042-01 · Note
• https://t.me/cibsecurity/71977 · Telegram Post
• https://forescout.com/company/blog/numberjack-forescout-research-labs-finds-nine-isn-generation-vulnerabilities-affecting-tcpip-stacks · Note
• https://t.me/cvenotify/59184 · Telegram Post
• https://forescout.com/resources/numberjack-weak-isn-generation-in-embedded-tcpip-stacks · Note
• https://forescout.com · Note
• https://securitylab.ru/news/516461.php · Note