CVE-2020-27009

 

Published at: - 22-04-2021 11:15

Last modified: - 05-08-2022 07:13

Total changes: - 7

Description

A vulnerability has been identified in Nucleus NET (All versions < V5.2), Nucleus Source Code (Versions including affected DNS modules). The DNS domain name record decompression functionality does not properly validate the pointer offset values. The parsing of malformed responses could result in a write past the end of an allocated structure. An attacker with a privileged position in the network could leverage this vulnerability to execute code in the context of the current process or cause a denial-of-service condition.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

 

Verification logic

 

Reference

• https://cert-portal.siemens.com/productcert/pdf/ssa-185699.pdf
• https://us-cert.cisa.gov/ics/advisories/icsa-21-103-04

 

Keywords

NVD

 

CVE-2020-27009

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures