nvd-json-data-feeds/CVE-2020/CVE-2020-356xx/CVE-2020-35683.json

{
  "id": "CVE-2020-35683",
  "sourceIdentifier": "cve@mitre.org",
  "published": "2021-08-19T12:15:07.353",
  "lastModified": "2022-07-12T17:42:04.277",
  "vulnStatus": "Analyzed",
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in HCC Nichestack 3.0. The code that parses ICMP packets relies on an unchecked value of the IP payload size (extracted from the IP header) to compute the ICMP checksum. When the IP payload size is set to be smaller than the size of the IP header, the ICMP checksum computation function may read out of bounds, causing a Denial-of-Service."
    },
    {
      "lang": "es",
      "value": "Se ha detectado un problema en HCC Nichestack versi\u00f3n 3.0. El c\u00f3digo que analiza los paquetes ICMP se basa en un valor no comprobado del tama\u00f1o de la carga \u00fatil IP (extra\u00eddo del encabezado IP) para calcular la suma de comprobaci\u00f3n ICMP. Cuando el tama\u00f1o de la carga \u00fatil IP est\u00e1 configurado para ser m\u00e1s peque\u00f1o que el tama\u00f1o del encabezado IP, la funci\u00f3n de c\u00e1lculo de la suma de comprobaci\u00f3n ICMP puede leer fuera de l\u00edmites, causando una Denegaci\u00f3n de Servicio."
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "accessVector": "NETWORK",
          "accessComplexity": "LOW",
          "authentication": "NONE",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 5.0
        },
        "baseSeverity": "MEDIUM",
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:hcc-embedded:nichestack:3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "22916BA2-C530-46C0-9C4E-1C0342C9089E"
            }
          ]
        }
      ]
    },
    {
      "operator": "AND",
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:siemens:7km9300-0ae02-0aa0_firmware:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "3.0.4",
              "matchCriteriaId": "894DD35F-1462-4045-AD87-5167B36348DC"
            }
          ]
        },
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:siemens:7km9300-0ae02-0aa0:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "65160F60-7D62-4473-841D-FE60B887A6CD"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-789208.pdf",
      "source": "cve@mitre.org",
      "tags": [
        "Mitigation",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://www.forescout.com/blog/new-critical-operational-technology-vulnerabilities-found-on-nichestack/",
      "source": "cve@mitre.org",
      "tags": [
        "Mitigation",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://www.hcc-embedded.com",
      "source": "cve@mitre.org",
      "tags": [
        "Product"
      ]
    },
    {
      "url": "https://www.kb.cert.org/vuls/id/608209",
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ]
    }
  ]
}