DNS Cache Poisoning Vulnerability in Nucleus NET and Nucleus ReadyStart by Siemens
CVE-2021-27393

5.3MEDIUM

Key Information:

Vendor

Siemens
Status
Nucleus Net
Nucleus Readystart V3
Nucleus Source Code
Vendor
CVE Published:
22 April 2021

What is CVE-2021-27393?

A vulnerability exists in Nucleus NET and related products that impacts the DNS client’s ability to randomize UDP port numbers for requests. This flaw can potentially allow attackers to exploit the DNS cache, enabling them to execute cache poisoning attacks or spoof DNS responses, which might lead to users being redirected to malicious sites or other forms of malicious activities.

Affected Version(s)

Nucleus NET All versions

Nucleus ReadyStart V3 All versions < V2013.08

Nucleus Source Code Versions including affected DNS modules

References

https://cert-portal.siemens.com/productcert/pdf/ssa-20138...
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.