{"api_version":"1","generated_at":"2026-07-23T07:10:09+00:00","cve":"CVE-2015-3963","urls":{"html":"https://cve.report/CVE-2015-3963","api":"https://cve.report/api/cve/CVE-2015-3963.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2015-3963","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2015-3963"},"summary":{"title":"CVE-2015-3963","description":"Wind River VxWorks before 5.5.1, 6.5.x through 6.7.x before 6.7.1.1, 6.8.x before 6.8.3, 6.9.x before 6.9.4.4, and 7.x before 7 ipnet_coreip 1.2.2.0, as used on Schneider Electric SAGE RTU devices before J2 and other devices, does not properly generate TCP initial sequence number (ISN) values, which makes it easier for remote attackers to spoof TCP sessions by predicting an ISN value.","state":"PUBLISHED","assigner":"icscert","published_at":"2015-08-04 01:59:07","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-330","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"5.8","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:P","baseScore":5.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://www.securitytracker.com/id/1033181","name":"http://www.securitytracker.com/id/1033181","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"VxWorks Predictable TCP Sequence Number Generation Lets Remote Users Deny Service or Spoof Connections - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://ics-cert.us-cert.gov/advisories/ICSA-15-169-01A","name":"https://ics-cert.us-cert.gov/advisories/ICSA-15-169-01A","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","US Government Resource"],"title":"Wind River VXWorks TCP Predictability Vulnerability in ICS Devices (Update B) | CISA","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/75302","name":"http://www.securityfocus.com/bid/75302","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"Wind River VxWorks CVE-2015-3963 Predictable TCP Initial Sequence Security Bypass Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://ics-cert.us-cert.gov/advisories/ICSA-15-169-01","name":"https://ics-cert.us-cert.gov/advisories/ICSA-15-169-01","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","US Government Resource"],"title":"Wind River VXWorks TCP Predictability Vulnerability in ICS Devices (Update B) | CISA","mime":"text/html","httpstatus":"200","archivestatus":"403"},{"url":"http://www.schneider-electric.com/ww/en/download/document/SEVD-2015-162-01","name":"http://www.schneider-electric.com/ww/en/download/document/SEVD-2015-162-01","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"],"title":"Security Notification - SAGE RTU - Download Schneider Electric","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://security.netapp.com/advisory/ntap-20160324-0001/","name":"https://security.netapp.com/advisory/ntap-20160324-0001/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"CVE-2015-3963 VxWorks Vulnerability impacting NetApp E-Series/EF-Series SANtricity OS Controller Firmware | NetApp Product Security","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id/1032730","name":"http://www.securitytracker.com/id/1032730","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"Schneider Electric SAGE Remote Terminal Unit Predictable TCP Sequence Numbers Let Remote Users Spoof TCP Connections - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-3963","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3963","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2015","cve_id":"3963","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"windriver","cpe5":"vxworks","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"3963","vulnerable":"1","versionEndIncluding":"6.6","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"windriver","cpe5":"vxworks","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2015-3963","qid":"591377","title":"ABB Relion 670 series Version 2.0 Transmission Control Protocol (TCP) Predictability Multiple Vulnerabilities (1MRG023264)"},{"cve":"CVE-2015-3963","qid":"591383","title":"ABB RTU500 series \"Transmission Control Protocol (TCP) Predictability Multiple Vulnerabilities (ABB-VU-PGGA-1KGT090284)"},{"cve":"CVE-2015-3963","qid":"591384","title":"ABB Relion 670 series \"Transmission Control Protocol (TCP) Predictability Multiple Vulnerabilities (1MRG028797)"},{"cve":"CVE-2015-3963","qid":"591399","title":"General Electric D20MX Transmission Control Protocol (TCP) Initial Sequence Number Vulnerability (PRBT-0375)"}]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T06:04:01.028Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"75302","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/75302"},{"name":"1032730","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id/1032730"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.schneider-electric.com/ww/en/download/document/SEVD-2015-162-01"},{"tags":["x_refsource_MISC","x_transferred"],"url":"https://ics-cert.us-cert.gov/advisories/ICSA-15-169-01A"},{"name":"1033181","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id/1033181"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://security.netapp.com/advisory/ntap-20160324-0001/"},{"tags":["x_refsource_MISC","x_transferred"],"url":"https://ics-cert.us-cert.gov/advisories/ICSA-15-169-01"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2015-06-18T00:00:00.000Z","descriptions":[{"lang":"en","value":"Wind River VxWorks before 5.5.1, 6.5.x through 6.7.x before 6.7.1.1, 6.8.x before 6.8.3, 6.9.x before 6.9.4.4, and 7.x before 7 ipnet_coreip 1.2.2.0, as used on Schneider Electric SAGE RTU devices before J2 and other devices, does not properly generate TCP initial sequence number (ISN) values, which makes it easier for remote attackers to spoof TCP sessions by predicting an ISN value."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-11-09T10:57:01.000Z","orgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","shortName":"icscert"},"references":[{"name":"75302","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/75302"},{"name":"1032730","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id/1032730"},{"tags":["x_refsource_CONFIRM"],"url":"http://www.schneider-electric.com/ww/en/download/document/SEVD-2015-162-01"},{"tags":["x_refsource_MISC"],"url":"https://ics-cert.us-cert.gov/advisories/ICSA-15-169-01A"},{"name":"1033181","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id/1033181"},{"tags":["x_refsource_CONFIRM"],"url":"https://security.netapp.com/advisory/ntap-20160324-0001/"},{"tags":["x_refsource_MISC"],"url":"https://ics-cert.us-cert.gov/advisories/ICSA-15-169-01"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"ics-cert@hq.dhs.gov","ID":"CVE-2015-3963","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Wind River VxWorks before 5.5.1, 6.5.x through 6.7.x before 6.7.1.1, 6.8.x before 6.8.3, 6.9.x before 6.9.4.4, and 7.x before 7 ipnet_coreip 1.2.2.0, as used on Schneider Electric SAGE RTU devices before J2 and other devices, does not properly generate TCP initial sequence number (ISN) values, which makes it easier for remote attackers to spoof TCP sessions by predicting an ISN value."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"75302","refsource":"BID","url":"http://www.securityfocus.com/bid/75302"},{"name":"1032730","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1032730"},{"name":"http://www.schneider-electric.com/ww/en/download/document/SEVD-2015-162-01","refsource":"CONFIRM","url":"http://www.schneider-electric.com/ww/en/download/document/SEVD-2015-162-01"},{"name":"https://ics-cert.us-cert.gov/advisories/ICSA-15-169-01A","refsource":"MISC","url":"https://ics-cert.us-cert.gov/advisories/ICSA-15-169-01A"},{"name":"1033181","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1033181"},{"name":"https://security.netapp.com/advisory/ntap-20160324-0001/","refsource":"CONFIRM","url":"https://security.netapp.com/advisory/ntap-20160324-0001/"},{"name":"https://ics-cert.us-cert.gov/advisories/ICSA-15-169-01","refsource":"MISC","url":"https://ics-cert.us-cert.gov/advisories/ICSA-15-169-01"}]}}}},"cveMetadata":{"assignerOrgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","assignerShortName":"icscert","cveId":"CVE-2015-3963","datePublished":"2015-08-04T01:00:00.000Z","dateReserved":"2015-05-12T00:00:00.000Z","dateUpdated":"2024-08-06T06:04:01.028Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2015-08-04 01:59:07","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-330","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:P","baseScore":5.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:windriver:vxworks:*:*:*:*:*:*:*:*","versionStartIncluding":"6.5","versionEndIncluding":"6.6","matchCriteriaId":"8F8C5727-B863-4B2D-896B-B079CC49FEBA"},{"vulnerable":true,"criteria":"cpe:2.3:o:windriver:vxworks:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.7.1.1","matchCriteriaId":"12D324CD-4AAD-484B-BC8D-B0C7A76FC556"},{"vulnerable":true,"criteria":"cpe:2.3:o:windriver:vxworks:*:*:*:*:*:*:*:*","versionStartIncluding":"6.8","versionEndExcluding":"6.8.3","matchCriteriaId":"F1E97899-D5E5-4C4D-A553-B15F1DD31041"},{"vulnerable":true,"criteria":"cpe:2.3:o:windriver:vxworks:*:*:*:*:*:*:*:*","versionStartIncluding":"6.9","versionEndExcluding":"6.9.4.4","matchCriteriaId":"D1DE1FEF-4519-45F6-867D-5248A6B4753C"},{"vulnerable":true,"criteria":"cpe:2.3:o:windriver:vxworks:6.6.3:*:*:*:cert:*:*:*","matchCriteriaId":"ABFC811A-A440-464A-B5C8-1DB9DEAEEAF1"},{"vulnerable":true,"criteria":"cpe:2.3:o:windriver:vxworks:6.6.4:*:*:*:cert:*:*:*","matchCriteriaId":"A048ED68-46C5-49B3-9A8E-12F90CE1B6FB"},{"vulnerable":true,"criteria":"cpe:2.3:o:windriver:vxworks:6.6.4.1:*:*:*:cert:*:*:*","matchCriteriaId":"44AE1224-EFE0-4BA9-8250-1C4BB2F37301"},{"vulnerable":true,"criteria":"cpe:2.3:o:windriver:vxworks:7.0:*:*:*:*:*:*:*","matchCriteriaId":"D4810B35-06F6-4971-BE87-A30B1CF58AA0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:schneider-electric:sage_1210:-:*:*:*:*:*:*:*","matchCriteriaId":"A16A7B3E-0B50-4577-A27C-75422924226C"},{"vulnerable":false,"criteria":"cpe:2.3:h:schneider-electric:sage_1230:-:*:*:*:*:*:*:*","matchCriteriaId":"8EA1F2F1-F8C3-427B-AD6F-778AF0193996"},{"vulnerable":false,"criteria":"cpe:2.3:h:schneider-electric:sage_1250:-:*:*:*:*:*:*:*","matchCriteriaId":"7A95CFF8-563A-45B1-B038-E9DD1AB5C4D0"},{"vulnerable":false,"criteria":"cpe:2.3:h:schneider-electric:sage_1310:-:*:*:*:*:*:*:*","matchCriteriaId":"C9592965-4A3B-4AD8-81F3-EDECC295B567"},{"vulnerable":false,"criteria":"cpe:2.3:h:schneider-electric:sage_1330:-:*:*:*:*:*:*:*","matchCriteriaId":"AEC4C5D0-DB9C-419A-B30B-62514DEDE901"},{"vulnerable":false,"criteria":"cpe:2.3:h:schneider-electric:sage_1350:-:*:*:*:*:*:*:*","matchCriteriaId":"4D66C8C1-E611-47B1-B9CF-32689F86B392"},{"vulnerable":false,"criteria":"cpe:2.3:h:schneider-electric:sage_1410:-:*:*:*:*:*:*:*","matchCriteriaId":"02E606BD-92F8-4396-AD13-666D76E1E34D"},{"vulnerable":false,"criteria":"cpe:2.3:h:schneider-electric:sage_1430:-:*:*:*:*:*:*:*","matchCriteriaId":"97E29CCC-4E21-411E-80DD-545A66E9B042"},{"vulnerable":false,"criteria":"cpe:2.3:h:schneider-electric:sage_1450:-:*:*:*:*:*:*:*","matchCriteriaId":"66759867-027F-4FA6-ABA6-BFDEE49E8F8D"},{"vulnerable":false,"criteria":"cpe:2.3:h:schneider-electric:sage_2200:-:*:*:*:*:*:*:*","matchCriteriaId":"82032E41-EE2D-4DC4-8420-6BFE92593061"},{"vulnerable":false,"criteria":"cpe:2.3:h:schneider-electric:sage_2400:-:*:*:*:*:*:*:*","matchCriteriaId":"AA561E2A-4787-48D7-ABBB-26D0D7D24E6F"},{"vulnerable":false,"criteria":"cpe:2.3:h:schneider-electric:sage_3030:-:*:*:*:*:*:*:*","matchCriteriaId":"88F83471-9806-4169-937E-27BDF3FC5A57"},{"vulnerable":false,"criteria":"cpe:2.3:h:schneider-electric:sage_3030_magnum:-:*:*:*:*:*:*:*","matchCriteriaId":"453696F2-0F4C-4000-A438-F814D0FC3504"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2015","CveId":"3963","Ordinal":"1","Title":"CVE-2015-3963","CVE":"CVE-2015-3963","Year":"2015"},"notes":[{"CveYear":"2015","CveId":"3963","Ordinal":"1","NoteData":"Wind River VxWorks before 5.5.1, 6.5.x through 6.7.x before 6.7.1.1, 6.8.x before 6.8.3, 6.9.x before 6.9.4.4, and 7.x before 7 ipnet_coreip 1.2.2.0, as used on Schneider Electric SAGE RTU devices before J2 and other devices, does not properly generate TCP initial sequence number (ISN) values, which makes it easier for remote attackers to spoof TCP sessions by predicting an ISN value.","Type":"Description","Title":"CVE-2015-3963"},{"CveYear":"2015","CveId":"3963","Ordinal":"2","NoteData":"2015-08-03","Type":"Other","Title":"Published"},{"CveYear":"2015","CveId":"3963","Ordinal":"3","NoteData":"2017-11-09","Type":"Other","Title":"Modified"}]}}}