PT-2021-2232 · Picotcp · Picotcp

Amine Amri + 3 · Published 2021-03-05 · Updated 2023-10-13 · CVE-2020-27635

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions PicoTCP version 1.7.0

Description The issue is related to the improper randomness of TCP Initial Sequence Numbers (ISNs) in the PicoTCP stack implementation. This could potentially allow a remote attacker to gain unauthorized access to protected information. The vulnerability is associated with the use of insufficiently random values.

Recommendations For PicoTCP version 1.7.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

Related Identifiers

BDU:2021-01177

CVE-2020-27635

Affected Products

Picotcp

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2020-27635 · Security Note
• https://osv.dev/vulnerability/CVE-2020-27635 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01177 · Security Note
• https://github.com/virtualsquare/picotcp/tree/v2.1 · Note
• https://cisa.gov/news-events/ics-advisories/icsa-21-042-01 · Note
• https://forescout.com/company/resources/amnesia33-how-tcp-ip-stacks-breed-critical-vulnerabilities-in-iot-ot-and-it-devices · Note
• https://securitylab.ru/news/516461.php · Note
• https://forescout.com/company/blog/numberjack-forescout-research-labs-finds-nine-isn-generation-vulnerabilities-affecting-tcpip-stacks · Note
• https://securitylab.ru/vulnerability/516454.php · Note
• https://cybersecurity-help.cz/vdb/SB2021021018 · Note
• https://forescout.com/resources/numberjack-weak-isn-generation-in-embedded-tcpip-stacks · Note
• https://forescout.com · Note