CVE-2020-25926

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The DNS client in InterNiche NicheStack TCP/IP 4.0.1 is affected by: Insufficient entropy in the DNS transaction id. The impact is: DNS cache poisoning (remote). The component is: dns_query_type(). The attack vector is: a specific DNS response packet.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-331

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.forescout.com/blog/new-critical-operational-technology-vulnerabilities-found-on-nichestack/Mitigation, Third Party Advisory
https://www.kb.cert.org/vuls/id/608209Third Party Advisory, US Government Resource
https://www.kb.cert.org/vuls/id/608209Third Party Advisory, US Government Resource
https://www.kb.cert.org/vuls/id/608209Third Party Advisory, US Government Resource
https://www.kb.cert.org/vuls/id/608209Third Party Advisory, US Government Resource
https://www.forescout.com/blog/new-critical-operational-technology-vulnerabilities-found-on-nichestack/Mitigation, Third Party Advisory
https://www.kb.cert.org/vuls/id/608209Third Party Advisory, US Government Resource
https://www.kb.cert.org/vuls/id/608209Third Party Advisory, US Government Resource
https://www.kb.cert.org/vuls/id/608209Third Party Advisory, US Government Resource
https://www.kb.cert.org/vuls/id/608209Third Party Advisory, US Government Resource

Timeline

Published: Aug 18, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-259277.5The DNS feature in InterNiche NicheStack TCP/IP 4.0.1 is affected by: Out-of-bounds Read. The impact is: a denial of service (remote). The c CVE-2020-259289.8The DNS feature in InterNiche NicheStack TCP/IP 4.0.1 is affected by: Buffer Overflow. The impact is: execute arbitrary code (remote). The c CVE-2020-25934.8Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported versions that are affected are J CVE-2020-25946.5Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Project CVE-2020-25955.8Vulnerability in the Oracle GraalVM Enterprise Edition product of Oracle GraalVM (component: GraalVM Compiler). The supported version that i CVE-2020-259504.3Advanced Webhost Billing System 3.7.0 is affected by Cross Site Request Forgery (CSRF) attacks that can delete a contact from the My Additio CVE-2020-259529.8SQL injection vulnerability in PHPGurukul User Registration & Login and User Management System With admin panel 2.1 allows remote attackers CVE-2020-259555.4SourceCodester Student Management System Project in PHP version 1.0 is vulnerable to stored a cross-site scripting (XSS) via the 'add subjec CVE-2020-25964.7Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Message Hooks). Supported versions that CVE-2020-259667.5Sectona Spectra before 3.4.0 has a vulnerable SOAP API endpoint that leaks sensitive information about the configured assets without proper CVE-2020-259678.8The member center function in fastadmin V1.0.0.20200506_beta is vulnerable to a Server-Side Template Injection (SSTI) vulnerability.CVE-2020-259699.8gnuplot v5.5 was discovered to contain a buffer overflow via the function plotrequest().