PT-2021-3981 · Hcc · Hcc Embedded Interniche

Published 2021-05-28 · Updated 2022-07-12 · CVE-2021-31228

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions HCC embedded InterNiche version 4.0.1

Description The issue allows an attacker to predict a DNS query's source port, enabling them to send forged DNS response packets that will be accepted as valid answers to the DNS client's requests. This is possible because the data is predictable, based on the time of day, and has too few bits.

Recommendations For HCC embedded InterNiche version 4.0.1, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of Insufficiently Random Values

RCE

Weakness Enumeration

CWE-330

CWE-20

CWE-340

Related Identifiers

BDU:2021-04500

CVE-2021-31228

Affected Products

Hcc Embedded Interniche

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2021-31228 · Security Note
• https://osv.dev/vulnerability/CVE-2021-31228 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04500 · Security Note
• https://securitylab.ru/vulnerability/523160.php · Note
• https://cybersecurity-help.cz/vdb/SB2021080607 · Note
• https://us-cert.cisa.gov/ics/advisories/icsa-21-217-01 · Note
• https://t.me/cvenotify/20185 · Telegram Post
• https://t.me/cibsecurity/27577 · Telegram Post
• https://kb.cert.org/vuls/id/608209 · Note
• https://hcc-embedded.com/support/security-advisories · Note
• https://helpnetsecurity.com/2021/08/04/vulnerabilities-nichestack · Note
• https://forescout.com/blog/new-critical-operational-technology-vulnerabilities-found-on-nichestack · Note