LiveActive security incident?Get immediate response
CVE Record

CVE-2021-31228: An issue was discovered in HCC embedded InterNiche 4.0.1.

An issue was discovered in HCC embedded InterNiche 4.0.1. This vulnerability allows the attacker to predict a DNS query's source port in order to send forged DNS response packets that will be accepted as valid answers to the DNS client's requests (without sniffing the specific request). Data is predictable because it is based on the time of day, and has too few bits.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2021-31228 is a DNS trust weakness in HCC embedded InterNiche 4.0.1. A device using this stack may accept a forged DNS answer because the DNS source port can be predicted from time-of-day data with too little randomness. This could redirect device communications if the vulnerable DNS client is reachable by forged responses.

Executive priority

Treat this as an exposure-discovery item for OT and embedded environments, not as a confirmed emergency from the supplied evidence. The main business risk is silent redirection of device communications if vulnerable products are present and reachable by spoofed DNS traffic.

Technical view

The issue is predictable DNS query source-port selection in HCC embedded InterNiche 4.0.1. The CVE description says the port is time-based and has too few bits, allowing forged DNS responses to be accepted without sniffing the specific request. No CVSS vector, CWE, concrete affected device list, or vendor fix is included in the supplied bundle.

Likely exposure

Exposure is likely limited to embedded or operational-technology products that include HCC embedded InterNiche 4.0.1 and use its DNS client. The source bundle does not identify specific downstream vendors, models, firmware versions, or internet-facing exposure patterns.

Exploitation context

The bundle supports theoretical spoofing of DNS replies through predictable source ports. It does not show CISA KEV listing, active exploitation, public exploit use, or incident evidence for this CVE.

Researcher notes

Key evidence is narrow: predictable DNS source-port generation based on time of day in InterNiche 4.0.1. The supplied record lacks CVSS, CWE mapping, affected downstream products, patch status, and exploitation evidence. Avoid product conclusions until vendor or firmware evidence confirms stack usage.

Mitigation direction

  • Inventory embedded and OT assets for HCC embedded InterNiche 4.0.1 or NicheStack references.
  • Check HCC, device vendor, and CERT guidance for product-specific firmware updates or mitigations.
  • Restrict untrusted traffic that can reach device DNS clients or spoof DNS responses.
  • Use trusted DNS infrastructure and network segmentation for affected embedded environments.
  • Prioritize compensating controls where vendor patches are unavailable or unconfirmed.

Validation and detection

  • Search asset SBOMs, firmware notes, and vendor advisories for InterNiche 4.0.1.
  • Confirm whether affected devices perform DNS lookups in operational workflows.
  • Review network paths where forged DNS replies could reach embedded clients.
  • Check DNS logs for suspicious answer changes or unexpected resolver interactions.
  • Document vendor response status for each potentially affected device family.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-31228 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.