CVE-2015-3963
Wind River VxWorks before 5.5.1, 6.5.x through 6.7.x before 6.7.1.1, 6.8.x before 6.8.3, 6.9.x before 6.9.4.4, and 7.x before 7 ipnet_coreip 1.2.2.0, as used on Schneider Electric SAGE RTU devices before J2 and other devices, does not properly generate…
Does this matter?
Lower severity and a low EPSS score (3.74%). Track it; it rarely justifies an emergency change on its own.
Description
Wind River VxWorks before 5.5.1, 6.5.x through 6.7.x before 6.7.1.1, 6.8.x before 6.8.3, 6.9.x before 6.9.4.4, and 7.x before 7 ipnet_coreip 1.2.2.0, as used on Schneider Electric SAGE RTU devices before J2 and other devices, does not properly generate TCP initial sequence number (ISN) values, which makes it easier for remote attackers to spoof TCP sessions by predicting an ISN value.
- CVSS 2.0
- 5.8 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:P
- EPSS
- 3.74% probability · 89th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-330
- Affected
- windriver/vxworks
- Source
- ics-cert@hq.dhs.gov
References
- http://www.schneider-electric.com/ww/en/download/document/SEVD-2015-162-01Patch, Third Party Advisory
- http://www.securityfocus.com/bid/75302Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1032730Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1033181Third Party Advisory, VDB Entry
- https://ics-cert.us-cert.gov/advisories/ICSA-15-169-01Third Party Advisory, US Government Resource
- https://ics-cert.us-cert.gov/advisories/ICSA-15-169-01AThird Party Advisory, US Government Resource
- https://security.netapp.com/advisory/ntap-20160324-0001/Third Party Advisory
- http://www.schneider-electric.com/ww/en/download/document/SEVD-2015-162-01Patch, Third Party Advisory
- http://www.securityfocus.com/bid/75302Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1032730Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1033181Third Party Advisory, VDB Entry
- https://ics-cert.us-cert.gov/advisories/ICSA-15-169-01Third Party Advisory, US Government Resource
- https://ics-cert.us-cert.gov/advisories/ICSA-15-169-01AThird Party Advisory, US Government Resource
- https://security.netapp.com/advisory/ntap-20160324-0001/Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.