Summary
Multiple products of PILZ utilise a third-party TCP/IP implementation - the "Niche Ethernet Stack". This TCP/IP stack contains multiple vulnerabilities which are therefore affecting the products listed above.
Impact
Die Schwachstellen ermöglichen einem entfernten Angreifer:
- einen Neustart des Geräts auszulösen, was zu einer Denial-of-Service-Situation führt
- eine TCP-Verbindung zu kapern
Betroffene Produkte und CVEs
| Produkt | Betroffen von CVEs |
|---|---|
| PSSu-Module für dezentrales E/A-System | CVE-2020-35683, CVE-2020-35684, CVE-2020-35685, CVE-2021-31400, CVE-2021-31401 |
| PSSu-Module für PSS 4000 | CVE-2020-35683, CVE-2020-35684, CVE-2020-35685, CVE-2021-31400, CVE-2021-31401 |
| PNOZ m B1 | CVE-2020-35683, CVE-2020-35684, CVE-2020-35685 |
| PNOZ m ES ETH | CVE-2020-35683, CVE-2020-35684, CVE-2020-35685 |
| PNOZ mmc1p ETH | CVE-2020-35683, CVE-2020-35684, CVE-2020-35685 |
| Base-Device PNOZ mxp ETH (PNOZmulti Classic) | CVE-2020-35683, CVE-2020-35684, CVE-2020-35685 |
Affected Product(s)
| Model no. | Product name | Affected versions |
|---|---|---|
| 773103, 773104*, 773113, 773116, 773123, 7731260 | Base-Device PNOZ mxp ETH (PNOZmulti Classic) | Firmware vers:all/* |
| 316020 | PNOZ m B1 | Firmware <v1.8 |
| 316020 | PNOZ m ES ETH | Firmware <v1.2 |
| 316020 | PNOZ mmc1p ETH | Firmware vers:all/* |
| 31206*, 312070*, 312071*, 312077, 312085*, 312087, 31407*, 314085, 314086, 314087, 315070*, 315071*, 315085, 315086, 316010, 316020 | PSSu-Module for PSS 4000 | Firmware 1.22.2 |
| 312041, 312042, 312043 | PSSu-Module for decentralised E/A-System | Firmware vers:all/* |
Vulnerabilities
Expand / Collapse allThis advisory characterizes the vulnerability differently from the official CVE record. For full details, please see the CSAF document.
An issue was discovered in HCC Nichestack 3.0. The code that generates Initial Sequence Numbers (ISNs) for TCP connections derives the ISN from an insufficiently random source. As a result, an attacker may be able to determine the ISN of current and future TCP connections and either hijack existing ones or spoof future ones. (Proper ISN generation should aim to follow at least the specifications outlined in RFC 6528.)
This advisory characterizes the vulnerability differently from the official CVE record. For full details, please see the CSAF document.
An issue was discovered in tcp_rcv() in nptcp.c in HCC embedded InterNiche 4.0.1. The TCP header processing code doesn't sanitize the value of the IP total length field (header length + data length). With a crafted IP packet, an integer overflow occurs whenever the value of the IP data length is calculated by subtracting the length of the header from the total length of the IP packet.
This advisory characterizes the vulnerability differently from the official CVE record. For full details, please see the CSAF document.
An issue was discovered in tcp_pulloutofband() in tcp_in.c in HCC embedded InterNiche 4.0.1. The TCP out-of-band urgent-data processing function invokes a panic function if the pointer to the end of the out-of-band data points outside of the TCP segment's data. If the panic function hadn't a trap invocation removed, it will enter an infinite loop and therefore cause DoS (continuous loop or a device reset).
This advisory characterizes the vulnerability differently from the official CVE record. For full details, please see the CSAF document.
An issue was discovered in HCC Nichestack 3.0. The code that parses TCP packets relies on an unchecked value of the IP payload size (extracted from the IP header) to compute the length of the TCP payload within the TCP checksum computation function. When the IP payload size is set to be smaller than the size of the IP header, the TCP checksum computation function may read out of bounds (a low-impact write-out-of-bounds is also possible).
This advisory characterizes the vulnerability differently from the official CVE record. For full details, please see the CSAF document.
An issue was discovered in HCC Nichestack 3.0. The code that parses ICMP packets relies on an unchecked value of the IP payload size (extracted from the IP header) to compute the ICMP checksum. When the IP payload size is set to be smaller than the size of the IP header, the ICMP checksum computation function may read out of bounds, causing a Denial-of-Service.
Mitigation
It is adviced to use firewalls or similar network security devices to prevent unauthorized network communication to the products affected.
Remediation
| Produkt | Maßnahme |
|---|---|
| PSSu-Module für dezentrales E/A-System | siehe Mitigation |
| PSSu-Module für PSS 4000 | Firmware auf 1.22.2 aktualisieren * |
| PNOZ m B1 | siehe Mitigation ** |
| PNOZ m ES ETH | siehe Mitigation ** |
| PNOZ mmc1p ETH | siehe Mitigation |
| Base-Device PNOZ mxp ETH (PNOZmulti Classic) | siehe Mitigation |
* CVE-2020-35685 wird in diesem Update nicht behoben, da es keine Auswirkungen auf die Sicherheit der verwendeten Dienste und Protokolle (MODBUS/TCP und RAW-TCP) hat.
** Diese Produkte sind im Feld nicht updatefähig. Sie verwenden eine vom Hersteller vorinstallierte, feste Firmware.
Acknowledgments
Pilz GmbH & Co. KG thanks the following parties for their efforts:
- CERT@VDE for coordination (see https://certvde.com )
- Forescout Technologies, Inc. for discovered and reported
Revision History
| Version | Date | Summary |
|---|---|---|
| 1 | 09/20/2021 13:56 | Initial revision. |
| 2 | 05/14/2025 15:00 | Fix: added distribution |