Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

ICS/OT

Siemens Releases Several Advisories for ‘NAME:WRECK’ Vulnerabilities

Siemens released a total of 14 new advisories on Tuesday, including five describing the impact and remediations for the NAME:WRECK vulnerabilities disclosed on the same day.

Siemens released a total of 14 new advisories on Tuesday, including five describing the impact and remediations for the NAME:WRECK vulnerabilities disclosed on the same day.

IoT security company Forescout on Tuesday revealed that four popular TCP/IP stacks — specifically FreeBSD, Siemens’ Nucleus, IPnet and NetX — are affected by a total of nine DNS-related flaws that can be exploited for remote code execution (including to take control of targeted devices), DoS attacks, and DNS cache poisoning.

The vulnerabilities, collectively tracked as NAME:WRECK, could affect billions of devices that use these TCP/IP stacks for network communications, but Forescout researchers estimate that at least 100 million devices are exposed to attacks.

Siemens on Tuesday published several advisories related to NAME:WRECK: one advisory to describe two out-of-bounds write flaws that can lead to code execution or DoS attacks, another advisory for a DNS cache poisoning issue, one advisory for two DoS vulnerabilities, and two advisories for the same four DoS and DNS cache poisoning flaws (one is for impact on the SIMOTICS CONNECT 400 remote motor monitoring system).

Affected products include Nucleus 4, Nucleus NET, Nucleus RTOS, Nucleus ReadyStart, and VSTAR, as well as the Nucleus source code. Siemens has released patches for some of the impacted products and it has also provided workarounds and mitigations to reduce the risk until a patch can be installed or becomes available.

Learn more about vulnerabilities in industrial systems at SecurityWeek’s ICS Cyber Security Conference and SecurityWeek’s Security Summits virtual event series

Forescout wrote in its report on the NAME:WRECK vulnerabilities, “According to the website of Nucleus RTOS(which runs the Nucleus TCP/IP stack), it is deployed in more than 3 billion devices. A quick look at Siemens’ page listing customer success stories reveals its use in scenarios such as healthcare (ZOLL defibrillators and ZONARE ultrasound machines), IT (BDT AG storage systems) and critical sys-tems (Garmin avionics navigation). But we believe that most of those 3 billion are actually device components such as MediaTek IoT chipsets and baseband processors used in smartphones and other wireless devices (which is similar to the distribution seen below for ThreadX).”

Siemens on Tuesday also published advisories for vulnerabilities affecting TIM 4R-IE, LOGO! Soft Comfort, Siveillance Video Open Network Bridge (ONVIF), Opcenter Quality, QMS Automotive, Control Center Server (CCS), Tecnomatix RobotExpert, SCALANCE X-200, Solid Edge, and SINEMA Remote Connect Server products.

Advertisement. Scroll to continue reading.

Schneider Electric advisories

Schneider Electric on Tuesday published two new security advisories. One of them describes four high- and one medium-severity vulnerabilities affecting the C-Bus Toolkit, which is used to configure and commission C-Bus installations. The flaws, related to the handling of files, can be exploited for remote code execution.

The second advisory from Schneider describes a couple of old Windows vulnerabilities affecting its NTZ Mekhanotronika Rus control panels.

Related: Siemens Releases Several Advisories for Vulnerabilities in Third-Party Components

Related: Siemens Patches 21 More File Parsing Vulnerabilities in PLM Products

Related: Siemens Releases Patches to Prevent Remote Takeover of SIMATIC HMI Panels

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Learn how the LOtL threat landscape has evolved, why traditional endpoint hardening methods fall short, and how adaptive, user-aware approaches can reduce risk.

Watch Now

Join the summit to explore critical threats to public cloud infrastructure, APIs, and identity systems through discussions, case studies, and insights into emerging technologies like AI and LLMs.

Register

People on the Move

Jessica Newman has joined Sophos as General Manager of Global Cyber Insurance.

Breach and attack simulation solutions provider AttackIQ has appointed Pete Luban as Field Chief Information Security Officer.

Matthew Cowell has assumed the role of VP of Strategic Alliances at Nozomi Networks. He previously served in the same role at Dragos.

More People On The Move

Expert Insights

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time.