VulnerabilityModified

CVE-2021-27393

A vulnerability has been identified in Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2013.08), Nucleus Source Code (Versions including affected DNS modules).

MEDIUM 5.3EPSS 0.75%

Does this matter?

Lower severity and a low EPSS score (0.75%). Track it; it rarely justifies an emergency change on its own.

Description

A vulnerability has been identified in Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2013.08), Nucleus Source Code (Versions including affected DNS modules). The DNS client does not properly randomize UDP port numbers of DNS requests. That could allow an attacker to poison the DNS cache or spoof DNS resolving.

CVSS 3.1: 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS: 0.75% probability · 53th percentile
CISA KEV: Not listed
Weakness: CWE-330
Affected: siemens/nucleus net · siemens/nucleus readystart v3 · siemens/nucleus source code
Source: productcert@siemens.com

References

https://cert-portal.siemens.com/productcert/pdf/ssa-201384.pdfVendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-201384.pdfVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.