A vulnerability has been identified in Nucleus 4 (All versions < V4.1.0), Nucleus NET (All versions), Nucleus RTOS (versions including affected DNS modules), Nucleus ReadyStart (All versions < V2017.02.3), Nucleus Source Code (versions including affected DNS modules), SIMOTICS CONNECT 400 (All versions < V0.5.0.0), VSTAR (versions including affected DNS modules). The DNS domain name record decompression functionality does not properly validate the pointer offset values. The parsing of malformed responses could result in a read access past the end of an allocated structure. An attacker with a privileged position in the network could leverage this vulnerability to cause a denial-of-service condition.

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-27738
• https://cert-portal.siemens.com/productcert/pdf/ssa-669158.pdf
• https://cert-portal.siemens.com/productcert/pdf/ssa-705111.pdf
• https://cert-portal.siemens.com/productcert/pdf/ssa-180579.pdf