#VU50594 Use of insufficiently random values in uC/TCP-IP - CVE-2020-27630

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU50594

#VU50594 Use of insufficiently random values in uC/TCP-IP - CVE-2020-27630

Published: February 10, 2021


Vulnerability identifier: #VU50594
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2020-27630
CWE-ID: CWE-330
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vulnerable software:
uC/TCP-IP
Software vendor:
Weston Embedded

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the ISN generator relies on LCG, which is reversible from observed output streams. A remote attacker can interfere with traffic, spoof the connection and gain access to sensitive information.


Remediation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

External links