Full Report
Security researchers discovered and disclosed 9 vulnerabilities in several DNS implementations, also known as “NAME:WRECK” vulnerabilities. The vulnerability described in this advisory is from this set. The DNS client of of the networking component (Nucleus NET) in Nucleus Real-Time Operating System (RTOS) contains a vulnerability related to the handling of UDP port numbers in DNS requests that could allow an attacker to poison the DNS cache or spoof DNS resolving. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not available.
Analysis Summary
# Vulnerability: NAME:WRECK DNS Implementation Flaw in Nucleus RTOS
## CVE Details
- **CVE ID:** CVE-2020-27736 (Associated with the specific Nucleus NET flaw described)
- **CVSS Score:** 6.5 (Medium)
- **CWE:** CWE-330: Use of Insufficiently Random Values / CWE-345: Insufficient Verification of Data Authenticity
## Affected Systems
- **Products:** Siemens Nucleus Real-Time Operating System (RTOS) utilizing the Nucleus NET networking component.
- **Versions:** Nucleus RTOS versions prior to v2021.05; specifically versions including Nucleus NET, Nucleus Source, and Nucleus ReadyStart.
- **Configurations:** Systems utilizing the built-in DNS client to resolve domain names via UDP.
## Vulnerability Description
This vulnerability is part of the **"NAME:WRECK"** set of flaws affecting DNS implementations in TCP/IP stacks. The Nucleus NET DNS client fails to properly randomize or validate UDP source port numbers in DNS requests. Because the transaction IDs and/or port numbers are predictable or not sufficiently verified, a remote attacker can predict the parameters of an outgoing query.
## Exploitation
- **Status:** Proof-of-Concept (PoC) available; Disclosed by security researchers (Forescout/JSOF). No widespread exploitation in the wild reported at the time of initial disclosure.
- **Complexity:** Medium
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** None
- **Integrity:** Partial (Allows for DNS Cache Poisoning and spoofing of DNS responses)
- **Availability:** None (Though redirection could lead to further service disruption)
## Remediation
### Patches
- Siemens has released updates for affected products. Users are advised to upgrade to **Nucleus RTOS v2021.05** or later.
- For specific industrial products (e.g., SIMATIC, SINAMICS), refer to the Siemens ProductCERT portal for version-specific firmware updates.
### Workarounds
- **Disable DNS:** If DNS resolution is not strictly required, disable the DNS client in the Nucleus configuration.
- **Restrict DNS Traffic:** Use a firewall or security appliance to restrict DNS traffic only to trusted internal DNS servers.
- **Egress Filtering:** Implement strict UDP port filtering to prevent external spoofed packets from reaching the device.
## Detection
- **Indicators of Compromise:** Unusual DNS resolution patterns or an influx of unsolicited DNS responses to the device.
- **Detection Methods:**
- Use Deep Packet Inspection (DPI) to monitor for DNS responses that do not match outstanding requests.
- Utilize vulnerability scanners (such as Forescout’s open-source "project-memphis" scripts) designed to identify NAME:WRECK vulnerabilities in embedded stacks.
## References
- Siemens ProductCERT: hxxps[://]cert-portal[.]siemens[.]com/
- Forescout NAME:WRECK Research: hxxps[://]www[.]forescout[.]com/blog/new-namewreck-vulnerabilities-impact-four-tcpip-stacks/
- ICS-CERT Advisory: hxxps[://]www[.]cisa[.]gov/news-events/ics-advisories/icsa-21-103-04