Full Report
Security researchers discovered and disclosed 9 vulnerabilities in several DNS implementations, also known as “NAME:WRECK” vulnerabilities. The vulnerabilities described in this advisory are from this set. The DNS client of the networking component (Nucleus NET) in Nucleus Real-Time Operating System (RTOS) contains two out of bounds write vulnerabilities in the handling of DNS responses that could allow an attacker to cause a denial-of-service condition or to remotely execute code. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not available.
Analysis Summary
# Vulnerability: NAME:WRECK DNS Flaws in Siemens Nucleus RTOS
## CVE Details
* **CVE ID:** CVE-2020-27736, CVE-2020-27737
* **CVSS Score:** 9.8 (Critical)
* **CWE:** CWE-787 (Out-of-bounds Write)
## Affected Systems
* **Products:** Siemens Nucleus Real-Time Operating System (RTOS) and specific products utilizing the Nucleus NET networking component.
* **Versions:** All versions of Nucleus RTOS incorporating the affected Nucleus NET stack (specifically those preceding the released patches).
* **Configurations:** Systems configured to use the Nucleus DNS client to resolve domain names via external or untrusted DNS servers.
## Vulnerability Description
Part of the "NAME:WRECK" series of vulnerabilities, these flaws exist in how the Nucleus NET DNS client parses incoming DNS responses. The implementation fails to properly validate the boundaries of memory buffers when processing compressed domain names (DNS message compression) or variable-length resource records. An attacker can craft a malicious DNS response containing malformed compression pointers or length fields that trigger an out-of-bounds write, leading to memory corruption.
## Exploitation
* **Status:** Proof-of-Concept (PoC) available; researchers have demonstrated the technical feasibility. No widespread exploitation in the wild reported at the time of disclosure.
* **Complexity:** Medium (Requires intercepting DNS traffic or acting as a malicious DNS server).
* **Attack Vector:** Network (Remote).
## Impact
* **Confidentiality:** High (Potential for data exfiltration via code execution).
* **Integrity:** High (Potential for unauthorized modification of system state).
* **Availability:** High (Potential for system crashes or infinite loops causing Denial-of-Service).
## Remediation
### Patches
* **Nucleus ReadyStart:** Update to v4.1.0 or later.
* **Nucleus Source Code:** Siemens has released updated versions of the Nucleus NET stack. Users should contact Siemens support or check the Siemens ProductCERT portal for specific version-mapping updates.
### Workarounds
* **DNS Inspection:** Configure firewalls or Deep Packet Inspection (DPI) tools to drop DNS traffic that does not conform to RFC standards or contains suspicious compression pointers.
* **Local DNS Resolution:** Use a trusted, secure DNS forwarder/proxy that validates responses before passing them to the RTOS client.
* **Disable DNS:** If DNS functionality is not critical for the device, disable the DNS client in the Nucleus configuration.
## Detection
* **Indicators of Compromise:** Unusual device reboots, network stack crashes, or outbound traffic to unexpected IP addresses.
* **Detection Methods:** Monitor network traffic for malformed DNS packets, specifically those utilizing recursive or circular compression pointers. Use IDS/IPS signatures specifically designed for NAME:WRECK vulnerabilities.
## References
* Siemens ProductCERT: hxxps[://]www[.]siemens[.]com/cert/advisories
* Forescout Research (NAME:WRECK): hxxps[://]www[.]forescout[.]com/blog/namewreck-breaking-the-dns-stack-in-iot-devices/
* ICS-CERT Advisory: hxxps[://]www[.]cisa[.]gov/news-events/ics-advisories/icsa-21-103-02