SB2023021013 - Use of insufficiently random values for TCP initial sequence numbers in Zuken Elmic KASAGO products
Published: February 10, 2023
Security Bulletin ID
SB2023021013
CSH Severity
High
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Use of insufficiently random values (CVE-ID: CVE-2022-43501)
The vulnerability allows a remote attacker to compromise communication between parties and perform spoofing attack.
The vulnerability exists due to usage of its own weak random number generator function when generating TCP initial sequence numbers. A remote attacker can guess the output produced by such generator and hijack future TCP sessions or perform spoofing attack.
Remediation
Install update from vendor's website.