{"id":"CVE-2020-28388","aliases":["EUVD-2020-20847","GHSA-j6gp-g45q-2wm2"],"status":"published","title":"A vulnerability has been identified in Nucleus NET (All versions \u003c V5.2), Nucleus ReadyStart for...","description":"A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions \u003c V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions \u003c V2.8.20), APOGEE PXC Modular (BACnet) (All versions \u003c V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions \u003c V2.8.20), Nucleus NET (All versions \u003c V5.2), Nucleus ReadyStart V3 (All versions \u003c V2012.12), Nucleus Source Code (All versions), PLUSCONTROL 1st Gen (All versions), TALON TC Compact (BACnet) (All versions \u003c V3.5.5), TALON TC Modular (BACnet) (All versions \u003c V3.5.5). Initial Sequence Numbers (ISNs) for TCP connections are derived from an insufficiently random source. As a result, the ISN of current and future TCP connections could be predictable. An attacker could hijack existing sessions or spoof future ones.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01367,"percentile":0.72048,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-342"],"published":"2021-02-09T00:00:00Z","modified":"2026-06-17T03:10:21Z","products":[{"vendor":"siemens","product":"apogee pxc compact (bacnet)"},{"vendor":"siemens","product":"apogee pxc compact (p2 ethernet)"},{"vendor":"siemens","product":"apogee pxc modular (bacnet)"},{"vendor":"siemens","product":"apogee pxc modular (p2 ethernet)"},{"vendor":"siemens","product":"capital_vstar"},{"vendor":"siemens","product":"nucleus net"},{"vendor":"siemens","product":"nucleus readystart v3"},{"vendor":"siemens","product":"nucleus source code"},{"vendor":"siemens","product":"nucleus_net"},{"vendor":"siemens","product":"nucleus_readystart"},{"vendor":"siemens","product":"nucleus_source_code"},{"vendor":"siemens","product":"pluscontrol 1st gen"},{"vendor":"siemens","product":"pluscontrol_1st_gen"},{"vendor":"siemens","product":"talon tc compact (bacnet)"},{"vendor":"siemens","product":"talon tc modular (bacnet)"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-362164.pdf","tags":["x_transferred","Vendor Advisory"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-344238.pdf","tags":["x_transferred","Vendor Advisory"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-436469.pdf","tags":["x_transferred"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-180579.pdf","tags":["x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-28388"},{"url":"https://github.com/advisories/GHSA-j6gp-g45q-2wm2"}],"sources":{"cve":[{"id":"CVE-2020-28388","description":"A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions \u003c V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions \u003c V2.8.20), APOGEE PXC Modular (BACnet) (All versions \u003c V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions \u003c V2.8.20), Nucleus NET (All versions \u003c V5.2), Nucleus ReadyStart V3 (All versions \u003c V2012.12), Nucleus Source Code (All versions), PLUSCONTROL 1st Gen (All versions), TALON TC Compact (BACnet) (All versions \u003c V3.5.5), TALON TC Modular (BACnet) (All versions \u003c V3.5.5). Initial Sequence Numbers (ISNs) for TCP connections are derived from an insufficiently random source. As a result, the ISN of current and future TCP connections could be predictable. An attacker could hijack existing sessions or spoof future ones.","status":"published","published":"2021-02-09T00:00:00Z","modified":"2026-06-02T20:14:56.054Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C","level":"medium","assessor":"cna"}],"cwes":["CWE-342"],"updated_at":"2026-11-02T14:35:57.017407Z"}],"euvd":[{"id":"EUVD-2020-20847","description":"A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions \u003c V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions \u003c V2.8.20), APOGEE PXC Modular (BACnet) (All versions \u003c V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions \u003c V2.8.20), Nucleus NET (All versions \u003c V5.2), Nucleus ReadyStart V3 (All versions \u003c V2012.12), Nucleus Source Code (All versions), PLUSCONTROL 1st Gen (All versions), TALON TC Compact (BACnet) (All versions \u003c V3.5.5), TALON TC Modular (BACnet) (All versions \u003c V3.5.5). Initial Sequence Numbers (ISNs) for TCP connections are derived from an insufficiently random source. As a result, the ISN of current and future TCP connections could be predictable. An attacker could hijack existing sessions or spoof future ones.","status":"published","published":"2021-02-09T00:00:00Z","modified":"2026-06-02T20:14:56Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C","level":"medium"}],"updated_at":"2026-11-02T18:20:55.231104Z"}],"ghsa":[{"id":"GHSA-j6gp-g45q-2wm2","title":"A vulnerability has been identified in Nucleus NET (All versions \u003c V5.2), Nucleus ReadyStart for...","description":"A vulnerability has been identified in Nucleus NET (All versions \u003c V5.2), Nucleus ReadyStart for ARM, MIPS, and PPC (All versions \u003c V2012.12). Initial Sequence Numbers (ISNs) for TCP connections are derived from an insufficiently random source. As a result, the ISN of current and future TCP connections could be predictable. An attacker could hijack existing sessions or spoof future ones.","status":"published","published":"2022-05-24T17:41:30Z","modified":"2023-08-08T12:30:17Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-342"],"updated_at":"2026-11-02T14:54:43.567376Z"}],"nvd":[{"id":"CVE-2020-28388","description":"A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions \u003c V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions \u003c V2.8.20), APOGEE PXC Modular (BACnet) (All versions \u003c V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions \u003c V2.8.20), Nucleus NET (All versions \u003c V5.2), Nucleus ReadyStart V3 (All versions \u003c V2012.12), Nucleus Source Code (All versions), PLUSCONTROL 1st Gen (All versions), TALON TC Compact (BACnet) (All versions \u003c V3.5.5), TALON TC Modular (BACnet) (All versions \u003c V3.5.5). Initial Sequence Numbers (ISNs) for TCP connections are derived from an insufficiently random source. As a result, the ISN of current and future TCP connections could be predictable. An attacker could hijack existing sessions or spoof future ones.","status":"published","published":"2021-02-09T18:15:34.59Z","modified":"2026-06-17T03:10:21.9Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-342"],"updated_at":"2026-11-02T14:06:34.188486Z"}]}}