PT-2021-3862 · Interniche · Nichestack Tcp/Ip

Published 2021-05-28 · Updated 2021-08-26 · CVE-2020-25926

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions InterNiche NicheStack TCP/IP version 4.0.1

Description The DNS client in InterNiche NicheStack TCP/IP is affected by insufficient entropy in the DNS transaction id, which can lead to DNS cache poisoning. The component dns query type() is involved, and the attack vector is a specific DNS response packet. This issue can be exploited remotely.

Recommendations For InterNiche NicheStack TCP/IP version 4.0.1, consider disabling the dns query type() function until a patch is available to prevent DNS cache poisoning attacks. Restrict access to the DNS client to minimize the risk of exploitation. Avoid using the DNS client with untrusted DNS responses until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of Insufficiently Random Values

RCE

Weakness Enumeration

CWE-331

CWE-330

CWE-20

Related Identifiers

BDU:2021-04220

CVE-2020-25926

Affected Products

Nichestack Tcp/Ip

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2020-25926 · Security Note
• https://bdu.fstec.ru/vul/2021-04220 · Security Note
• https://osv.dev/vulnerability/CVE-2020-25926 · Vendor Advisory
• https://t.me/cibsecurity/27562 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2021080607 · Note
• https://forescout.com/blog/new-critical-operational-technology-vulnerabilities-found-on-nichestack · Note
• https://us-cert.cisa.gov/ics/advisories/icsa-21-217-01 · Note
• https://kb.cert.org/vuls/id/608209 · Note
• https://t.me/cvenotify/20181 · Telegram Post
• https://hcc-embedded.com/support/security-advisories · Note
• https://helpnetsecurity.com/2021/08/04/vulnerabilities-nichestack · Note
• https://securitylab.ru/vulnerability/523160.php · Note