Session Hijacking Risk in Siemens APOGEE and Nucleus Products
CVE-2020-28388

6.5MEDIUM

Key Information:

Vendor
Siemens
Status
Apogee Pxc Compact (bacnet)
Apogee Pxc Compact (p2 Ethernet)
Apogee Pxc Modular (bacnet)
Apogee Pxc Modular (p2 Ethernet)
Vendor
CVE Published:
9 February 2021

Summary

A vulnerability has been discovered in several Siemens APOGEE and Nucleus products where Initial Sequence Numbers (ISNs) for TCP connections are generated from an insufficiently random source. This predictability may enable attackers to hijack active sessions or spoof future connections, exposing sensitive data and disrupting operations. Affected users should promptly apply the recommended patches to mitigate these risks and secure their network infrastructure.

Affected Version(s)

APOGEE PXC Compact (BACnet) All versions < V3.5.5

APOGEE PXC Compact (P2 Ethernet) All versions < V2.8.20

APOGEE PXC Modular (BACnet) All versions < V3.5.5

References

https://cert-portal.siemens.com/productcert/pdf/ssa-36216...
https://cert-portal.siemens.com/productcert/pdf/ssa-34423...
https://cert-portal.siemens.com/productcert/pdf/ssa-43646...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.