← Vulnerability feed

Vulnerability record · CVE-2020-27213 · published 10 October 2023

CVE-2020-27213: Ethernut nut\/os vulnerability

Ethernut · Nut\/Os

An issue was discovered in Ethernut Nut/OS 5.1. The code that generates Initial Sequence Numbers (ISNs) for TCP connections derives the ISN from an insufficiently random source. As a result, an attacker may be able to determine the ISN of current and future TCP connections and either hijack existing ones or spoof future ones. While the ISN generator seems to adhere to RFC 793 (where a global 32-bit counter is incremented roughly every 4 microseconds), proper ISN generation should aim to follow at least the specifications outlined in RFC 6528.

7.5 CVSS 3.1 High EPSS 0.97% · top 39.5% CWE-330 · CWE-330
7.5CVSS 3.1 base score
0.97%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
8References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

An issue was discovered in Ethernut Nut/OS 5.1. The code that generates Initial Sequence Numbers (ISNs) for TCP connections derives the ISN from an insufficiently random source. As a result, an attacker may be able to determine the ISN of current and future TCP connections and either hijack existing ones or spoof future ones. While the ISN generator seems to adhere to RFC 793 (where a global 32-bit counter is incremented roughly every 4 microseconds), proper ISN generation should aim to follow at least the specifications outlined in RFC 6528.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://lists.egnite.de/mailman/listinfo/en-nut-announce Not Applicable
http://www.ethernut.de/en/download/index.html Release Notes
https://www.cisa.gov/news-events/ics-advisories/icsa-21-042-01 Third Party AdvisoryUS Government Resource
https://www.forescout.com/resources/numberjack-weak-isn-generation-in-embedded-tcpip-stacks/ ExploitThird Party Advisory
http://lists.egnite.de/mailman/listinfo/en-nut-announce Not Applicable
http://www.ethernut.de/en/download/index.html Release Notes
https://www.cisa.gov/news-events/ics-advisories/icsa-21-042-01 Third Party AdvisoryUS Government Resource
https://www.forescout.com/resources/numberjack-weak-isn-generation-in-embedded-tcpip-stacks/ ExploitThird Party Advisory

Track CVE-2020-27213 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2020-25107Nut/OS DNS resolver missing null-termination check allows DoS and possible RCEThe DNS implementation in Ethernut Nut/OS 5.1 does not verify that a domain name is '\0' terminated, an out-of-bounds read condition. A malformed DNS…EPSS 54%analysed9.8CVE-2020-25108Ethernut Nut/OS DNS response length flaw allows out-of-bounds writeThe DNS implementation in Ethernut Nut/OS 5.1 does not validate the length field of DNS response data, so a packet can set an arbitrary length. This …EPSS 54%analysed9.8CVE-2020-25109Ethernut Nut/OS DNS header count out-of-bounds readThe DNS implementation in Ethernut Nut/OS 5.1 does not validate the query/response count in the DNS header against the actual data present, causing a…EPSS 54%analysed9.8CVE-2020-25110Ethernut Nut/OS DNS length byte flaw allows denial of service and possible RCEThe DNS implementation in Ethernut Nut/OS 5.1 fails to validate the length byte of a domain name in DNS queries and responses, then uses that value f…EPSS 54%analysed

Source: NIST National Vulnerability Database (record CVE-2020-27213), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.