Security Experts:

Connect with us

Hi, what are you looking for?



Siemens Releases Several Advisories for ‘NAME:WRECK’ Vulnerabilities

Siemens released a total of 14 new advisories on Tuesday, including five describing the impact and remediations for the NAME:WRECK vulnerabilities disclosed on the same day.

Siemens released a total of 14 new advisories on Tuesday, including five describing the impact and remediations for the NAME:WRECK vulnerabilities disclosed on the same day.

IoT security company Forescout on Tuesday revealed that four popular TCP/IP stacks — specifically FreeBSD, Siemens’ Nucleus, IPnet and NetX — are affected by a total of nine DNS-related flaws that can be exploited for remote code execution (including to take control of targeted devices), DoS attacks, and DNS cache poisoning.

The vulnerabilities, collectively tracked as NAME:WRECK, could affect billions of devices that use these TCP/IP stacks for network communications, but Forescout researchers estimate that at least 100 million devices are exposed to attacks.

Siemens on Tuesday published several advisories related to NAME:WRECK: one advisory to describe two out-of-bounds write flaws that can lead to code execution or DoS attacks, another advisory for a DNS cache poisoning issue, one advisory for two DoS vulnerabilities, and two advisories for the same four DoS and DNS cache poisoning flaws (one is for impact on the SIMOTICS CONNECT 400 remote motor monitoring system).

Affected products include Nucleus 4, Nucleus NET, Nucleus RTOS, Nucleus ReadyStart, and VSTAR, as well as the Nucleus source code. Siemens has released patches for some of the impacted products and it has also provided workarounds and mitigations to reduce the risk until a patch can be installed or becomes available.

Learn more about vulnerabilities in industrial systems at SecurityWeek’s ICS Cyber Security Conference and SecurityWeek’s Security Summits virtual event series

Forescout wrote in its report on the NAME:WRECK vulnerabilities, “According to the website of Nucleus RTOS(which runs the Nucleus TCP/IP stack), it is deployed in more than 3 billion devices. A quick look at Siemens’ page listing customer success stories reveals its use in scenarios such as healthcare (ZOLL defibrillators and ZONARE ultrasound machines), IT (BDT AG storage systems) and critical sys-tems (Garmin avionics navigation). But we believe that most of those 3 billion are actually device components such as MediaTek IoT chipsets and baseband processors used in smartphones and other wireless devices (which is similar to the distribution seen below for ThreadX).”

Siemens on Tuesday also published advisories for vulnerabilities affecting TIM 4R-IE, LOGO! Soft Comfort, Siveillance Video Open Network Bridge (ONVIF), Opcenter Quality, QMS Automotive, Control Center Server (CCS), Tecnomatix RobotExpert, SCALANCE X-200, Solid Edge, and SINEMA Remote Connect Server products.

Schneider Electric advisories

Schneider Electric on Tuesday published two new security advisories. One of them describes four high- and one medium-severity vulnerabilities affecting the C-Bus Toolkit, which is used to configure and commission C-Bus installations. The flaws, related to the handling of files, can be exploited for remote code execution.

The second advisory from Schneider describes a couple of old Windows vulnerabilities affecting its NTZ Mekhanotronika Rus control panels.

Related: Siemens Releases Several Advisories for Vulnerabilities in Third-Party Components

Related: Siemens Patches 21 More File Parsing Vulnerabilities in PLM Products

Related: Siemens Releases Patches to Prevent Remote Takeover of SIMATIC HMI Panels

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Expert Insights

Related Content

CISO Strategy

Cybersecurity-related risk is a top concern, so boards need to know they have the proper oversight in place. Even as first-timers, successful CISOs make...

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

IoT Security

Lexmark warns of a remote code execution (RCE) vulnerability impacting over 120 printer models, for which PoC code has been published.


Otorio has released a free tool that organizations can use to detect and address issues related to DCOM authentication.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Email Security

Microsoft is urging customers to install the latest Exchange Server updates and harden their environments to prevent malicious attacks.

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.


Security researchers have observed an uptick in attacks targeting CVE-2021-35394, an RCE vulnerability in Realtek Jungle SDK.