CVE-2020-27736

 

Published at: - 22-04-2021 11:15

Last modified: - 05-08-2022 07:13

Total changes: - 6

Description

A vulnerability has been identified in Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.3), Nucleus ReadyStart V4 (All versions < V4.1.0), Nucleus Source Code (Versions including affected DNS modules), SIMOTICS CONNECT 400 (All versions < V0.5.0.0). The DNS domain name label parsing functionality does not properly validate the null-terminated name in DNS-responses. The parsing of malformed responses could result in a read past the end of an allocated structure. An attacker with a privileged position in the network could leverage this vulnerability to cause a denial-of-service condition or leak the read memory.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H

 

Verification logic

 

Reference

• https://cert-portal.siemens.com/productcert/pdf/ssa-705111.pdf
• https://cert-portal.siemens.com/productcert/pdf/ssa-669158.pdf

 

Keywords

NVD

 

CVE-2020-27736

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures