RESEARCH REPORT | NUCLEUS:13

NUCLEUS: 13
Dissecting the Nucleus TCP/IP stack
By Forescout Research Labs & Medigate Labs

Forescout Research Labs

Daniel dos Santos
Stanislav Dashevskyi
Amine Amri

Medigate Labs
Uriel Malin
Tal Zohar
Yuval Halaban
RESEARCH REPORT | NUCLEUS:13

Table of Contents

1. Executive Summary.......................................................................................................3
2. Main Findings.................................................................................................................5
2.1. What is Nucleus NET?................................................................................................5

2.2. Why analyze Nucleus NET?........................................................................................5

2.3. Analysis and findings................................................................................................6

3. Attack Scenarios Leveraging NUCLEUS:13.................................................................7

3.1. Scenario 1: hacking the hospital..................................................................................7

3.2. Scenario 2: crashing the trains....................................................................................9

4. Impact...........................................................................................................................10
5. Mitigation Recommendations...................................................................................14
6. Technical Dive-In: Exploiting CVE-2021-31886........................................................15
6.1. Root cause analysis..................................................................................................16

6.2. Exploiting a QEMU image.........................................................................................17

6.3. Exploiting a WAGO 750-852......................................................................................23

7. Conclusions..................................................................................................................27

FORESCOUT RESEARCH LABS

RESEARCH REPORT | NUCLEUS:13 | Executive Summary

1. Executive Summary
• In the fifth study of Project Memoria – • The new vulnerabilities allow for Remote
NUCLEUS:13 – Forescout Research Labs and Code Execution or Denial of Service, with
Medigate Labs identified a set of 13 new three of the thirteen new vulnerabilities
vulnerabilities affecting the Nucleus TCP/IP being critical and having CVSS scores of
stack. either 9.8 or 8.8.
• Nucleus is currently owned by Siemens. • Forescout Research Labs and Medigate
Originally released in 1993, Nucleus has Labs exploited one of the Remote Code
been deployed in many industries that Execution vulnerabilities in their labs and
have safety and security requirements, demonstrated that a successful attack could
such as medical devices, automotive and potentially disrupt medical care and other
industrial systems. critical processes.
• Upon identifying new vulnerabilities, • Two of the recommended mitigations
Forescout Research Labs and Medigate Labs for NUCLEUS:13 include using network
collaborated with Siemens, CISA, CERT/CC segmentation to limit the network
and other agencies to confirm the findings exposure of critical vulnerable devices
and notify vendors. and patching devices as vendors release
• According to the Siemens website, Nucleus their patches. Some vulnerabilities can
is deployed in three billion devices. also be mitigated by blocking or disabling
Anesthesia machines, ventilators and support for unused protocols, such as FTP.
patient monitors are among the medical
devices possibly impacted by NUCLEUS:13.

FORESCOUT RESEARCH LABS 3

RESEARCH REPORT | NUCLEUS:13 | Executive Summary

INFORMATIONAL

A recap on TCP/IP stacks

and Project Memoria
A TCP/IP stack is a piece of software that • AMNESIA:33, a set of 33 vulnerabilities
implements basic network communication for affecting four open-source TCP/IP stacks,
all IP-connected devices, including Internet disclosed in December 2020 by Forescout
of Things (IoT), operational technology (OT) Research Labs.
and information technology (IT). Not only • NUMBER:JACK, a set of nine vulnerabilities
are TCP/IP stacks widespread, they are affecting the Initial Sequence Number
notoriously vulnerable due to (i) codebases (ISN) implementation in nine TCP/IP stacks,
created decades ago and (ii) an attractive disclosed in February 2021 by Forescout
attack surface, including protocols that cross Research Labs.
network perimeters and an abundance of • NAME:WRECK, a set of nine vulnerabilities
unauthenticated functionality. affecting DNS clients of four TCP/IP stacks,
disclosed in April 2021 by Forescout
Given the impact of these foundational Research Labs and JSOF.
components, Forescout Research Labs has • INFRA:HALT, a set of 14 vulnerabilities
launched Project Memoria with the goal of affecting InterNiche’s NicheStack, disclosed
collaborating with industry peers and research in August 2021 by Forescout Research Labs
institutes to provide the cybersecurity and JFrog Security Research.
community with the largest analysis of the • NUCLEUS:13, a set of 13 vulnerabilities
security of TCP/IP stacks. affecting Siemens’ Nucleus TCP/IP stack,
disclosed in October 2021 by Forescout
The latest examples of TCP/IP stack Research Labs and Medigate Labs.
vulnerabilities include:
• Ripple20, a set of 19 vulnerabilities on the
Treck TCP/IP stack, disclosed by JSOF in June
2020. Forescout Research Labs worked in
close collaboration with JSOF to identify
vendors and devices potentially affected by
Ripple20.

FORESCOUT RESEARCH LABS 4

RESEARCH REPORT | NUCLEUS:13 | Main Findings

2. Main Findings
2.1. What is Nucleus NET? 2.2. Why analyze Nucleus NET?
Nucleus NET is the TCP/IP stack of the Nucleus We chose to analyze Nucleus NET because of
Real-time Operating System (RTOS). The stack its known uses in safety-critical applications,
and the RTOS were originally developed by as described above. Nucleus NET was the
Accelerated Technology, Inc. (ATI) in 1993, target of previous analyses in Project Memoria,
then acquired by Mentor Graphics in 2002 and during both NUMBER:JACK and NAME:WRECK.
finally by Siemens in 2017. Since its original Siemens also published two CVEs affecting the
release 28 years ago, Nucleus has been IPv6 components of the stack in 2021, which
deployed in many industries that have safety are similar to some issues seen on AMNESIA:33.
and security requirements, such as medical Table 1 summarizes the previously known
devices, automotive and industrial systems. vulnerabilities affecting Nucleus NET.
Nucleus is currently distributed as:
Since we had already analyzed Nucleus NET
• ReadyStart: Containing source code, a for specific vulnerabilities in NUMBER:JACK
suite of tools for development and analysis, and NAME:WRECK (TCP ISN generation and
middleware, board support packages (BSPs) DNS client, respectively), we investigated other
and examples components of the stack that we had access to.
• SafetyCert: A certified version of the
kernel with runtime libraries, connectivity
middleware, networking and data storage.
The certification package includes source
code and documentation with traceability
and hyperlinks for easier safety reviews
CVE IDs Description/Comment
DHCP client vulnerability allows attackers to change the IP address of a device to an invalid
CVE-2019-13939 value. Besides Nucleus, it also affects several devices in the APOGEE, TALON and Desigo lines
of building automation products
CVE-2020-15795
CVE-2020-27009
CVE-2020-27736
Set of DNS client vulnerabilities
CVE-2020-27737
Part of Project Memoria’s NAME:WRECK
CVE-2020-27738
CVE-2021-25677
CVE-2021-27393
Predictable TCP ISN vulnerability
CVE-2020-28388
Part of Project Memoria’s NUMBER:JACK
CVE-2021-25663
IPv6 vulnerabilities, similar to AMNESIA:33
CVE-2021-25664

Table 1 – Previously known vulnerabilities on Nucleus NET

FORESCOUT RESEARCH LABS 5

RESEARCH REPORT | NUCLEUS:13 | Main Findings

2.3. Analysis and findings We performed only a manual analysis of the

We performed a deeper analysis of two stack on both the source code and binary
versions of the stack: incomplete source versions. Table 2 shows the vulnerabilities that
code of version 4.3 (which we had analyzed we discovered.
in NUMBER:JACK and NAME:WRECK); and a
As shown in Table 2, most of the vulnerabilities
binary demo containing a newer version. In
allow for denial of service, while three allow
those versions, we analyzed the following stack
for remote code execution, a topic explored in
components: IPv4, ICMP, TCP, UDP, DHCP
subsequent sections of this report.
client, TFTP server and FTP server.

Affected Potential CVSSv3.1

CVE ID Description Component Impact Score
2021- ICMP echo packets with fake IP options allow sending ICMP echo reply messages Confused
ICMP 5.3
31344 to arbitrary hosts on the network. deputy
The total length of an UDP payload (set in the IP header) is unchecked. This may
2021- lead to various side effects, including Information Leak and Denial-of-Service Application-
UDP 7.5
31345 conditions, depending on a user-defined application that runs on top of the UDP dependent
protocol.
The total length of an ICMP payload (set in the IP header) is unchecked. This may
2021- Information
lead to various side effects, including Information Leak and Denial-of-Service IP / ICMP 8.2
31346 leak / DoS
conditions, depending on the network buffer organization in memory.
When processing a DHCP OFFER message, the DHCP client application does
2021-
not validate the length of the Vendor option(s), leading to Denial-of-Service DHCP client DoS 7.1
31881
conditions.
The DHCP client application does not validate the length of the Domain Name
2021-
Server IP option(s) (0x06) when processing DHCP ACK packets. This may lead to DHCP client DoS 6.5
31882
Denial-of-Service conditions.
When processing a DHCP ACK message, the DHCP client application does
2021-
not validate the length of the Vendor option(s), leading to Denial-of-Service DHCP client DoS 7.1
31883
conditions.
The DHCP client application assumes that the data supplied with the “Hostname”
2021- DHCP option is NULL terminated. In cases when global hostname variable is Application-
DHCP client 8.8
31884 not defined, this may lead to Out-of-Bound reads, writes and denial-of-service dependent
conditions.
2021- TFTP server application allows for reading the contents of the TFTP memory Information
TFTP server 7.5
31885 buffer by sending malformed TFTP commands. leak
FTP server does not properly validate the length of the “USER” command, leading
2021-
to stack-based buffer overflows. This may result in Denial-of-Service conditions FTP server RCE 9.8
31886
and Remote Code Execution.
FTP server does not properly validate the length of the “PWD/XPWD” command,
2021-
leading to stack-based buffer overflows. This may result in Denial-of-Service FTP server RCE 8.8
31887
conditions and Remote Code Execution.
FTP server does not properly validate the length of the “MKD/XMKD” command,
2021-
leading to stack-based buffer overflows. This may result in Denial-of-Service FTP server RCE 8.8
31888
conditions and Remote Code Execution.
2021- Malformed TCP packets with a corrupted SACK option leads to Information Leaks
TCP server DoS 7.5
31889 and Denial-of-Service conditions.
The total length of an TCP payload (set in the IP header) is unchecked. This may
2021-
lead to various side effects, including Information Leak and Denial-of-Service TCP server DoS 7.5
31890
conditions, depending on the network buffer organization in memory.
Table 2 – Discovered vulnerabilities. Rows are colored according to the CVSS score: yellow for medium or high and red for critical.

FORESCOUT RESEARCH LABS 6

RESEARCH REPORT | NUCLEUS:13 | Attack scenarios leveraging NUCLEUS:13

Siemens has released patches for all the in 2021 (after the NAME:WRECK disclosure)
vulnerabilities. Approximately half had already that listed critical vulnerable devices, such
been patched in existing versions of the stack as Siemens gas turbines, BD Alaris infusion
but never issued CVE IDs. pumps and GE healthcare devices.

As we have seen in NAME:WRECK with CVE- NUCLEUS:13 is the same, and in Section 6,
2016-20009 (which we independently found we discuss exploitation using one of the CVEs
on IPnet and had never been publicly reported that had been previously patched (CVE-2021-
with a CVE ID), vulnerabilities in TCP/IP stacks 31886) but still impacted devices with current
that have been silently patched may still affect firmware.
several devices. In the case of CVE-2016-20009
(whose ID indicates original discovery year of
2016), there were several advisories released

3. Attack Scenarios
Leveraging NUCLEUS:13
NUCLEUS:13 includes remote code execution Research Labs has shown that other types
and denial-of-service vulnerabilities that can of IoT devices, including building automation
be exploited by attackers to achieve different controllers, figure prominently among those
goals based on their motivations, such as to most impacted by TCP/IP stack vulnerabilities
gain a foothold into a network or wreak havoc. in healthcare organizations. The same holds
In this section, we discuss two examples of true for NUCLEUS:13, which impacts medical
attack scenarios that affect different industries devices, building automation devices and
but leverage the same FTP-based exploitation other types of OT and IoT devices (discussed in
(detailed in Section 6). Section 4).

A video showing both attacks as implemented Building automation devices are used in
in our lab can be found here. hospitals to control functions such as physical
3.1. Scenario 1: hacking the hospital access control, fire alarm systems, lighting
Although connected medical devices are and HVAC (heating, ventilation and air
currently (and justifiably) the focus of conditioning). These functions are not directly
much cybersecurity discussion, Forescout connected to patients, but they are critical to
delivering patient care.

FORESCOUT RESEARCH LABS 7

RESEARCH REPORT | NUCLEUS:13 | Attack scenarios leveraging NUCLEUS:13

HVAC systems, for instance, maintain To demonstrate how an attacker could

temperature, humidity and air quality leverage NUCLEUS:13 to disrupt the normal
throughout a hospital as dictated by functioning of a hospital’s building automation
regulations. Changing some of these systems, and thus impair patient care, we have
parameters can have disastrous consequences: implemented in our lab the scenario shown in
reduced ventilation can increase the spread Figure 1.
of airborne diseases, such as COVID-19; and
drastic changes in temperature can render
operating rooms unusable or spoil biological
samples.

Figure 1 – Attack implemented in the lab

In this scenario, a motion sensor, a light bulb Since the exploited vulnerability allows for
and a model fan are connected to a building code execution (discussed in Section 6), this
automation controller. When someone attack could be extended to allow the attacker
enters a patient’s room, the fan and lights to change temperature setpoints, control logic
switch on automatically, and they switch off and other variables in the controller. He could
automatically when the person leaves the also use the compromised device to issue
room. An attacker can crash the controller by malicious commands to other devices in the
sending a crafted FTP packet that exploits CVE- hospital. The main difference is that those
2021-31886 (or any other DoS in NUCLEUS:13). attacks would be highly targeted to a specific
When the attack is successful, the fan environment (i.e., a particular hospital with a
and lights stop working, thus creating an particular set of controllers and logic), whereas
environment where patient care is hindered. the denial of service works against several
targets, making it an easily commoditized asset
for cyber criminals).

FORESCOUT RESEARCH LABS 8

 RESEARCH REPORT | NUCLEUS:13 | Attack scenarios leveraging NUCLEUS:13

3.2. Scenario 2: crashing the trains in which operation is automated and an

Recently, railway infrastructure providers attendant remains on board in case of
around the world have been under attack, emergencies, and unattended train operation
including a ransomware incident in Germany (UTO) whereby operation is fully automated
in 2017, a DDoS attack in Denmark in 2018 without any on-board staff.
and a politically motivated hack of Iranian
The devices affected by NUCLEUS:13 are
Railways systems in July 2021. What these
not used only for healthcare and building
attacks have in common is that they impacted
automation. For example, the WAGO
the IT systems of the targeted organizations,
controllers which we exploited (see Section 6)
not their operational technology. However,
are also part of railway infrastructure, anything
as Check Point researchers mentioned in
from station automation to train maintenance
their analysis: “the extent and sophistication
and track signaling.
of attacks in general is still a fraction of its
To demonstrate how an attacker could
complete potential; oftentimes, threat actors
leverage NUCLEUS:13 to disrupt the normal
don’t do X, Y, Z even though they perfectly well
functioning of an automated train system, and
could.”
thus create the potential for major collisions,
Railways and trains are increasingly
we have implemented in our lab the scenario
automated, with grades of automation that
shown in Figure 2.
include driverless train operation (DTO)

Figure 2 – Attack implemented in the lab

FORESCOUT RESEARCH LABS 9

RESEARCH REPORT | NUCLEUS:13 | Impact

In this scenario, a presence sensor and a the controller by sending the same FTP packet
train model are connected to an automation that exploits CVE-2021-31886 described above
controller placed at a station. When the (or any other DoS in NUCLEUS:13). When the
sensor detects that the train is at the station, attack is successful, the train will not stop at
it controls the train to stop for a certain period the station, and thus can collide with another
of time, after which the train automatically train, people or other objects on the track.
continues its journey. An attacker can crash

4. Impact
In this section, we estimate the impact of that most of those three billion devices are
NUCLEUS:13 based on the evidence collected actually device components such as MediaTek
during our research, using three main sources: IoT chipsets and baseband processors used
• The official Nucleus website, which states in smartphones and other wireless devices.
that the RTOS is deployed in more than We also found technical documentation
three billion devices. A review of customer detailing the use of Nucleus for medical
success stories reveals its use in scenarios devices, such as the GE S/5 Avance
such as healthcare (ZOLL defibrillators and Anesthesia Machine (shown in Figure 3) and
ZONARE ultrasound machines), IT (BDT the Nihon Kohden Bedside Monitor (shown
AG storage systems) and critical systems in Figure 4).
(Garmin avionics navigation). Yet, we believe

Figure 3 – Documentation of a GE S/5 Avance Anesthesia Machine showing the use of Nucleus RTOS

FORESCOUT RESEARCH LABS 10

RESEARCH REPORT | NUCLEUS:13 | Impact

Figure 4 – Documentation of a Nihon Kohden patient monitor detailing an error message caused by Nucleus

• Shodan Queries. Shodan is a search

engine that allows users to look for devices
connected to the Internet. We queried Interestingly, these are the same queries we
Shodan, looking for devices showing some used during the NAME:WRECK research, and
evidence (e.g., application-layer banners) they show a decrease of 13% of FTP servers
indicating the use of Nucleus. As shown in and 25% of exposed devices running the
Figure 5 and Figure 6, with a query executed RTOS. We believe this is a direct positive effect
on 05/Aug/2021, we found more than of NAME:WRECK, which most likely brought
2,200 instances of devices running the increased attention to securing publicly exposed
Nucleus FTP server (“220 Nucleus FTP”) embedded devices.
or the RTOS (“Operating System: Nucleus
PLUS”).

FORESCOUT RESEARCH LABS 11

RESEARCH REPORT | NUCLEUS:13 | Impact

Figure 5 – Exposed devices running Nucleus FTP Figure 6 – Exposed devices running Nucleus RTOS (“Operating System:
(“220 Nucleus FTP”) Nucleus PLUS”)

• Forescout Device Cloud. Forescout Device instance. We found close to 5,500 devices
Cloud is a repository of information for from 16 vendors in place at 127 customers.
about 13+ million devices monitored by Thirteen of these customers had more than
Forescout appliances. We queried it for 100 vulnerable devices, with healthcare
similar banners to Shodan, as well as other being the most impacted sector
information, based on DHCP signatures, for (see Figure 7).

FORESCOUT RESEARCH LABS 12

RESEARCH REPORT | NUCLEUS:13 | Impact

Figure 7 – Device functions running Nucleus (source: Forescout Device Cloud)

Figure 8 – Devices running Nucleus in each vertical (source: Forescout Device Cloud)

As we have done with our previous research, to vendors impacted by NUCLEUS:13 on our
we will maintain a list of advisories related GitHub page.

FORESCOUT RESEARCH LABS 13

RESEARCH REPORT | NUCLEUS:13 | Mitigation Recommendations

5. Mitigation Recommendations
Complete protection against NUCLEUS:13 • Enforce segmentation controls and
requires patching devices running the proper network hygiene to mitigate
vulnerable versions of Nucleus. Siemens the risk from vulnerable devices. Restrict
has released its official patches, and device external communication paths and isolate
vendors using this software should provide or contain vulnerable devices in zones as a
their own updates to customers. Below, we mitigating control if they cannot be patched
discuss mitigation strategies for network or until they can be patched.
operators. • Monitor progressive patches released
Given that patching the embedded devices by affected device vendors and devise a
is notoriously difficult (due to their mission- remediation plan for your vulnerable asset
critical nature), we recommend the following inventory, balancing business risk and
mitigation strategy: business continuity requirements.
• Discover and inventory devices running • Monitor all network traffic for malicious
Nucleus. Forescout Research Labs has packets that try to exploit known
released an open-source script that uses vulnerabilities or possible zero-days. You
active fingerprinting to detect devices should block anomalous and malformed
running Nucleus. The script is updated traffic, or at least alert its presence to
constantly with new signatures to follow the network operators.
latest development of our research. Table 4 provides recommended mitigations for
each vulnerability.
CVE Affected Component Mitigation Recommendation
2021-31885
2021-31886
FTP / TFTP server Disable FTP/TFTP if not needed, or whitelist connections.
2021-31887
2021-31888
2021-31881 Use switch-based DHCP control mechanisms: protocol-aware network switches may
2021-31882 be configured to block DHCP responses from rogue servers (“DHCP snooping”)1.
DHCP client
2021-31883 Alternatively, firewalls can be configured in a similar fashion. As a last resort, use static IP
2021-31884 addresses.

2021-31344
2021-31345
Monitor traffic for malformed packets and block them. Having a vulnerable device behind
2021-31346 TCP / UDP / IP / ICMP
a properly configured firewall should be sufficient.
2021-31889
2021-31890

Table 4 – Mitigation recommendations for specific vulnerabilities

1 See https://kb.isc.org/docs/aa-00573

FORESCOUT RESEARCH LABS 14

RESEARCH REPORT | NUCLEUS:13 | Mitigation Recommendations

TECHNICAL DIVE-IN

6. Technical Dive-In:
Exploiting CVE-2021-31886

There are three vulnerabilities in NUCLEUS:13 constraints. Note that the exploitation does
that allow for Remote Code Execution: CVE- not require any authentication on the target,
2021-31886, CVE-2021-31887 and CVE-2021- as the vulnerability is triggered for any input of
31888. All three vulnerabilities affect the the “USER” command that has a specific length.
default FTP server application shipped with the The vulnerability is detailed in Section 6.1, and
Nucleus TCP/IP stack. In this section, we will the exploitation details are outlined in Sections
focus on CVE-2021-31886: unchecked input 6.2 and 6.3.
size of the USER command.
Important note on exploitability: Some of the
At a high level, to trigger CVE-2021-31886, technical details of the exploitation are specific
attackers perform authentication attempts to the hardware/firmware being exploited,
on the affected FTP server, sending the FTP including the presence of specific components
“USER” command with a username that is of the affected TCP/IP stack and the absence
larger than the internal buffer designated to of exploit mitigations. Some of the details
hold the input of this command (note that the discussed below may be specific to the chosen
actual size of this buffer may vary). Sending targets (QEMU image based on Nucleus Ready
a large enough username results in a stack- Start for NXP i.MX28 evaluation software, and
based buffer overflow, allowing performance WAGO 750-852 PLC with firmware version
of controlled writes into the memory of “01.07.21 (14)”, respectively).
the affected device, hijacking the execution
flow and executing attackers’ code with few

FORESCOUT RESEARCH LABS 15

RESEARCH REPORT | NUCLEUS:13 | Mitigation Recommendations

TECHNICAL DIVE-IN

6.1. Root cause analysis

The root cause of CVE-2021-31886 lies within The code fails to ensure that the buffer
the FSP_Server_USER() function that parses server->user that holds the supplied
the FTP “USER” command (shown in Figure 9). username is not overflown by the input.

Figure 9 – An excerpt from the FSP_Server_USER() function (CVE-2021-31886)

Figure 10 – Pseudocode excerpts from “FTP_SERVER”,

“NU_EVENT_GROUP” and “CS_NODE” structures

FORESCOUT RESEARCH LABS 16

RESEARCH REPORT | NUCLEUS:13 | Mitigation Recommendations

TECHNICAL DIVE-IN

The server variable is a pointer to a variable “USER”, one space character, 31 characters
that holds the FTP_SERVER structure (shown of username and the two “\r\n” characters.
in Figure 10). The server->replyBuff field However, if we place a null-terminator in an
holds the contents of the input buffer (in arbitrary place within server->replyBuff such
this case, the entire “USER” command). In that strlen() returns a value less than 38, we
our case, the contents of server->replyBuff can still copy a longer string into server->user,
are expected to be of the following format: provided that we place the “\r” character at a
“USER\x20username\x0d\x0a\x00”, where desired offset.
the command “USER” is followed by a space
In this way, we can overflow server->user, the
character (0x20), the “\r\n” characters and a
remaining fields of the FTP_SERVER structure
null terminator (0x00) that signifies the end of
as well as some local variables and the
the input string.
metadata of a stack frame, where FTP_SERVER
The username is then copied from is declared (server happens to be a pointer to
server->replyBuff into server->user (lines a local variable declared in the Control_Task()
21-24 in Figure 9). This code will copy a function). In essence, this is a stack-based
sequence of characters (up to 250) until the buffer overflow vulnerability.
first occurrence of the ‘\r’ character (0x0d or
6.2. Exploiting a QEMU image
13 in ASCII). It will finally add a null-terminator
In this Section, we describe the exploitation
to server->user (line 26 of Figure 9). Note, that
details, based on a QEMU image built for
server->user is, in fact, only 32-bytes long (see
Nucleus Ready Start for NXP i.MX28 evaluation
Figure 10).
software. We also managed to exploit this
At line 7 of Figure 9, the code checks whether vulnerability on a WAGO 750-852 PLC, which is
the input string server->replyBuff is not explained in Section 6.3.
larger than 38 characters, using the strlen()2
function. The expected contents of this buffer
are as follows: four characters for the string

2 strlen() returns the length of a byte sequence until the first 0x00 byte is encountered.

FORESCOUT RESEARCH LABS 17

RESEARCH REPORT | NUCLEUS:13 | Mitigation Recommendations

TECHNICAL DIVE-IN

The exploitation strategy involved the Figure 11 shows a pseudocode excerpt from
following steps: the Control_Task() function, which is an
1. Patch the address of the input buffer (e.g., RTOS task that is responsible for handling FTP
the buffer that stores the “USER” command), sessions. This function contains important local
so that it points to a different memory variables: FTP_SERVER server that contains a
location: This allows the attacker to have field user, which we intend to overflow; and
longer shellcode (we can upload only CHAR *buffer, which is a pointer to the buffer
218 bytes of shellcode at a time). This also that contains the raw user input (it will be later
helps to avoid overwriting the shellcode copied into server->replyBuff).
(e.g., by buffer deallocation and other
FTP commands).
2. Prepare the shellcode and upload it to a
desired location within the memory.
3. Redirect the execution flow to the shellcode.

Figure 11 – An excerpt from the Control_Task() function

FORESCOUT RESEARCH LABS 18

RESEARCH REPORT | NUCLEUS:13 | Mitigation Recommendations

TECHNICAL DIVE-IN

At this point, we can construct such input shellcode in some unused memory region
that will overflow the server->user field, where more space is available; (2) since
overwriting the fields of server past the Control_Task() is an RTOS task3, it runs in an
server->user field, as well as the local infinite loop and will not return as a traditional
variables in Control_Task() past server. C function; therefore, overwriting the return
We could also overwrite the return address address will at best cause a Denial-of-Service
of Control_Task() at this point and hijack under certain conditions but will not allow us
the execution flow. However, we incur two to hijack the execution flow in a useful way.
problems: (1) we still need to store our

Figure 12 – A chosen memory location for the shellcode

Our first goal is to find an executable region as writable in our case). Figure 12 shows an
of memory to store the shellcode. For this excerpt from this segment. It contains several
purpose, we have chosen the address static variables which are not used in the
0x000b22bc located in the .bss segment (this context of the FTP server and therefore is a
memory segment happens to be marked good location for our shellcode.

Figure 13 – The span_process_packet callback

3 Have a look at this blog post from CircuitsToday.com for a short overview of RTOS concepts.

FORESCOUT RESEARCH LABS 19

RESEARCH REPORT | NUCLEUS:13 | Mitigation Recommendations

TECHNICAL DIVE-IN

Since we cannot easily overwrite the return callback will be triggered when a particular LLC
address of Control_Task(), we must resort frame is received. Therefore, if we overwrite
to other means for redirecting the execution. the span_process_packet pointer with the
We have found several function pointers address of our shellcode and send the LLC
declared in the .bss memory segment. One frame4 that meets the right conditions, the
of them is called span_process_packet and it shellcode will be executed.
is set to zero by default. Figure 13 shows that To achieve this, we establish our first FTP
span_process_packet is a callback pointer, session with the target device and send a
and if the pointer contains a non-zero address malformed USER command with the
(it is supposed to be a function address), this following bytes:

The payload contains the following bytes: • The address of the shellcode (0x000b22c4,
• The “USER” command followed by a space big endian), the address of the span_
character (0x20) process_packet pointer (0x00b14f8, big
• Several dummy bytes that overflow the field endian)
server->user. Note that we have also placed When the field server->user is overwritten, we
a null-terminator (0x00) in the middle of will write the two addresses into the first eight
the input, so that the input length checks bytes of the server->FTP_Events field (see
(shown on Figure 9) will be circumvented. Figure 10; the addresses are marked in red
and green):

4 A Logical-Link Control (LLC) frame with the bytes 0x0026 or 0x0007 set in place of the ETHERTYPE/LENGTH field (bytes 13 and 14)
of the Ethernet header

FORESCOUT RESEARCH LABS 20

RESEARCH REPORT | NUCLEUS:13 | Mitigation Recommendations

TECHNICAL DIVE-IN

These addresses will, essentially, be written At this time, the pointers node->cs_previous
into the fields of the ev_created variable and node->cs_next are the same as server-
enclosed into server->FTP_events. >FTP_Events->ev_created->cs_previous and
server->FTP_Events->ev_created->cs_next,
and they point to the desired shellcode address
and the address of span_process_packet
After these addresses are written, we close pointer, respectively. After the code on line 10 is
the FTP session by sending a TCP RST packet. executed, we overwrite the value of the span_
When the session is closed, Control_Task() will process_packet pointer with our shellcode
eventually call the NU_Remove_From_List() address, which means that now this callback
function (shown in Figure 14). This function will is initialized, and whenever it is invoked, the
remove the current FTP event node from the shellcode will be executed.
FTP event list (lines 9-10).

Figure 14 – The NU_Remove_From_List() function

Next, we establish a new FTP session and of 52 bytes from the end of server->user, we
attempt to patch the buffer pointer and to simply construct an FTP user command that
write our shellcode at the desired location. To contains the new address of buffer at the
patch the address of buffer, we use the same required offset.
technique as before. As buffer lies at the offset

FORESCOUT RESEARCH LABS 21

RESEARCH REPORT | NUCLEUS:13 | Mitigation Recommendations

TECHNICAL DIVE-IN

Note that after the USER command is handled buffer points to the address that we now
and the execution returns to Control_Task(), control:

Note that this time, we are supplying the It is important that, at this time, we do not
address 0x000b22bc, which is different from close the current FTP session. Otherwise,
the shellcode address 0x00b22c4 that we set Control_Task() will allocate a new input buffer
during the previous step. This is because we pointer, and all the work we have done so far
are patching the raw input buffer. Apart from will be lost. Therefore, to supply the shellcode,
the user-supplied contents, it will include the we immediately follow with another USER
entire FTP command that starts with “USER\ command that will be written into the memory
x20”. Therefore, we will structure our input as starting at address 0x000b22bc. This time, it
“USER\x20\x00\x00\x00[shellcode]” and skip the contains the following shellcode:
first eight bytes to jump directly at the first
byte of the shellcode.

FORESCOUT RESEARCH LABS 22

RESEARCH REPORT | NUCLEUS:13 | Mitigation Recommendations

TECHNICAL DIVE-IN

Finally, we send an LLC frame that meets the executed. In this case, our shellcode simply
requirements for triggering the span_process_ prints a line to the serial console of
packet callback, and the shellcode gets the QEMU VM.

6.3. Exploiting a WAGO 750-852 because of the size limitations that constrain
The exploitation of CVE-2021-31886 in the stage 0. To do so, we needed to make
WAGO 750-852 PLC is similar to the QEMU stage 0 patch another function pointer ppe_
image exploitation. That is, we overflow the process_packet to point at a location which
server structure to have our shellcode residing we dynamically allocated. Whenever stage
at a stable location pointed to by the buffer 0 gets triggered again, it will copy shellcode
variable and calling it afterwards through fragments which we sent within the LLC frame
a patched span_process_packet function to be reassembled at the location pointed at by
pointer. ppe_process_packet. This pointer is another
After having a first payload running through callback (similar to span_process_packet)
span_process_packet (called “stage 0”), we which is called at the function EightZeroTwo, as
aimed at loading a second payload (“stage 1”) follows:

FORESCOUT RESEARCH LABS 23

RESEARCH REPORT | NUCLEUS:13 | Mitigation Recommendations

TECHNICAL DIVE-IN

The stage 0 shellcode is illustrated in Once the entire stage 1 shellcode is copied and
Figure 15. It allocates the memory for is in good order (ensured by the checksum),
stage 1 shellcode on lines 34-39. Whenever we patch the ppe_process_packet pointer to
stage 0 gets executed, it copies the fragments point at the beginning of stage 1 shellcode
of stage 1 shellcode in the right order and into (lines 53-64).
a designated memory location (lines 66-72).

FORESCOUT RESEARCH LABS 24

RESEARCH REPORT | NUCLEUS:13 | Mitigation Recommendations

TECHNICAL DIVE-IN

Figure 15 – stage 0 shellcode

FORESCOUT RESEARCH LABS 25

RESEARCH REPORT | NUCLEUS:13 | Mitigation Recommendations

TECHNICAL DIVE-IN

When this is done, we trigger the ppe_process_ of a particular page used in the embedded
packet callback by sending a crafted Point-to- webserver. The effect of this change is shown
Point Protocol over Ethernet (PPOE) frame. in Figure 16 (normal operation) and Figure 17
The stage 1 shellcode accesses the filesystem (after exploiting CVE-2021-31886).
of the WAGO PLC, changing the HTML code

Figure 16 – Web page as it appears normally in WAGO 750-852

Figure 17 – A defaced web page in WAGO 750-852

FORESCOUT RESEARCH LABS 26

RESEARCH REPORT | NUCLEUS:13 | Conclusion

7. Conclusions
In this report, we discussed NUCLEUS:13, a set by financial gains more than ever. This is
of 13 vulnerabilities affecting the Nucleus TCP/ especially true for operational technology and
IP stack, currently owned by Siemens and used the Internet of Things. The expanded adoption
in billions of devices. The vulnerabilities include of these types of technology by every type of
three RCEs, which we managed to exploit in organization, and their deep integration into
our labs as discussed in Section 3. We saw critical business operations, will only increase
evidence of the stack running in industrial their value for attackers over the long term.
controllers, building automation equipment,
With this context in mind, Forescout Research
and medical devices.
Labs and Medigate Labs look forward to
We strongly believe that the threat landscape analyzing additional software and devices,
for every type of connected device is changing driving opportunities for better industry
fast, with an ever-increasing number of severe collaboration and continuing to help secure
vulnerabilities and attackers being motivated the Enterprise of Things.

FORESCOUT RESEARCH LABS 27