CVE-2021-31401
High
Description
An issue was discovered in tcp_rcv() in nptcp.c in HCC embedded InterNiche 4.0.1. The TCP header processing code doesn't sanitize the value of the IP total length field (header length + data length). With a crafted IP packet, an integer overflow occurs whenever the value of the IP data length is calculated by subtracting the length of the header from the total length of the IP packet.
SeverityHigh
CVSS7.5
Exploit probability—
ProductHcc-embedded Nichestack
PublishedAug 19, 2021
First seenAug 19, 2021
How to fix
Update
- hcc-embedded nichestack4.3 or later
- siemens sentron_3wl_com35_firmware1.2.0 or later
- siemens sentron_3wa_com190_firmware2.0.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| hcc-embedded nichestack | v < 4.3 | 4.3 |
| siemens sentron_3wl_com35_firmware | v < 1.2.0 | 1.2.0 |
| siemens sentron_3wa_com190_firmware | v < 2.0.0 | 2.0.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.