Predictable UDP Port Number Vulnerability (NAME:WRECK) in the DNS Module of Nucleus RTOS

An attacker could poison the DNS cache on devices running vulnerable Nucleus RTOS, causing them to resolve control system commands, SCADA traffic, or operator instructions to attacker-controlled addresses, disrupting normal operations or enabling command injection.

Any facility using Siemens Nucleus RTOS-based embedded devices (controllers, RTUs, communicators) that rely on DNS for hostname resolution of remote servers, especially those resolving addresses for SCADA networks, historian connections, or remote engineering workstation communication. Affects industrial automation, power systems, water treatment, and manufacturing equipment.

An attacker with network access to the same network segment sends DNS responses with crafted UDP port numbers to devices running vulnerable Nucleus RTOS DNS clients. Because the port is predictable, the attacker's response can be received and cached before the legitimate DNS server's response, poisoning resolution for critical infrastructure hostnames or addresses.