Vulnerability · Published Aug 19, 2021 · Assigned by mitre

CVE-2021-31401

High 7.5

In plain English

A high-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 83% of all known vulnerabilities).

Severity (CVSS NVD)7.5High

Exploit odds (30 days)2.3%top 17.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

An issue was discovered in tcp_rcv() in nptcp.c in HCC embedded InterNiche 4.0.1. The TCP header processing code doesn't sanitize the value of the IP total length field (header length + data length). With a crafted IP packet, an integer overflow occurs whenever the value of the IP data length is calculated by subtracting the length of the header from the total length of the IP packet.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://cert-portal.siemens.com/productcert/pdf/ssa-789208.pdf x_refsource_CONFIRM
https://www.forescout.com/blog/new-critical-operational-technology-vulnerabilities-found-on-nichestack/ x_refsource_MISC
VU#608209 third-party-advisory, x_refsource_CERT-VN