CVE-2020-28388 Weak cryptography in APOGEE PXC Compact (BACnet)
Predictable TCP Initial Sequence Numbers allow attackers to hijack sessions or spoof connections in Siemens building automation systems.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-28388?
CVE-2020-28388 is a medium-severity vulnerability in Siemens APOGEE PXC Compact (BACnet), published on 9 Feb 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (All versions < V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.20), Nucleus NET (All versions < V5.2), Nucleus ReadyStart V3 (All versions < V2012.12), Nucleus Source Code (All versions), PLUSCONTROL 1st Gen (All versions), TALON TC Compact (BACnet) (All versions < V3.5.5), TALON TC Modular (BACnet) (All versions < V3.5.5). Initial Sequence Numbers (ISNs) for TCP connections are derived from an insufficiently random source. As a result, the ISN of current and future TCP connections could be predictable. An attacker could hijack existing sessions or spoof future ones.
Weakness: CWE-342
Which versions are affected by CVE-2020-28388?
It affects 5 products.
Products include Siemens Capital Vstar, Siemens Nucleus Net, Siemens Nucleus Readystart, Siemens Nucleus Source Code, Siemens Pluscontrol 1st Gen.
How do I fix CVE-2020-28388?
No fix has been published for CVE-2020-28388 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-28388 being exploited?
There is no known exploitation of CVE-2020-28388 in the wild and no public exploit code.
Other vulnerabilities in Siemens APOGEE PXC Compact (BACnet)
Sources
Also known as GHSA-j6gp-g45q-2wm2.