Insufficient Randomness in TCP Initial Sequence Number Generation in Ethernut Nut/OS

CVE-2020-27213

What is CVE-2020-27213?

A vulnerability exists in Ethernut Nut/OS 5.1 relating to the generation of Initial Sequence Numbers (ISNs) for TCP connections. The ISNs are derived from a source that lacks adequate randomness, making them predictable. This flaw could allow an attacker to determine the ISN for both existing and future TCP connections. Consequently, attackers may hijack ongoing sessions or spoof future connections, raising significant security concerns. Adopting improved randomization methods, as detailed in RFC 6528, is crucial for enhancing the security of ISN generation.

References