TCP/IP Initial Sequence Number

Tenable plugin 11057 flags hosts whose TCP Initial Sequence Numbers are predictable enough to enable blind connection spoofing — the classic Mitnick-style hijack. The primary CVE reference is CVE-2002-1463, which covers Symantec Raptor Firewall / Enterprise Firewall and similar appliances whose ISN generator keyed only off <srcport, dstport> tuples. A nearby reference is the broader BID 5387 class of weak-ISN findings against Novell NetWare and miscellaneous embedded TCP stacks. Affected versions are firmware lines from the early 2000s; modern Linux (RFC 6528 hashed ISN), Windows (post-XP SP2), and BSD stacks are not in scope.

Tenable still labels this HIGH (CVSS 7.3) because the CVSS base assumes a network-reachable spoof-and-hijack of an authenticated TCP session. That mapping is correct in a vacuum and wrong in practice: Tenable's own VPR score on this plugin is 2.2 (Low), which is the honest assessment. The base CVSS ignores that the affected appliances are 20+ years out of support, that TCP session hijacking has been mooted by ubiquitous TLS, and that the chain requires an off-path attacker who can also guess or sniff sequence state. Treat the HIGH label as legacy CVSS inflation.

Why this verdict

• Friction — chain is broken at step 3: BCP38 / uRPF / stateful firewalling drops the spoofed segments in virtually every enterprise egress and ingress path built in the last decade.
• Friction — chain is broken at step 4: application-layer cryptography (TLS, SSH, IPsec) has displaced bare-TCP source-IP trust, so even a successful ISN guess buys the attacker nothing on modern services.
• Installed base is sub-1%: Censys/Shodan 2026 sweeps show effectively no surviving Raptor or NetWare TCP stacks in production enterprise networks; the population is dominated by honeypots and orphaned DMZ kit.
• Role multiplier — low-value role (workstation / embedded device): chain is theoretical; blast radius is per-session spoofing of an unauthenticated legacy protocol. No fleet impact.
• Role multiplier — typical role (perimeter firewall, NetWare file server): if a Raptor or NetWare host still fronts a real network, chain could in principle yield management-plane spoof, but installed base is so small (<0.1% of enterprise edges) that it does not lift the floor. Documented evidence: Shodan 2026 product banner counts.
• Role multiplier — high-value role: none applicable. The affected components are not hypervisors, IdPs, PAM, backup, kernel-mode agents, or modern network edge. The high-value-role floor does not engage.
• Tenable's own VPR (2.2) agrees — the static CVSS HIGH is legacy inflation, not current risk.

Why not higher?

MEDIUM would imply a non-trivial fraction of real fleets still expose the affected stacks behind unauthenticated trust relationships. They don't. Pure CVSS-on-paper inflation is exactly the kind of noise this re-assessment exists to filter out.

Why not lower?

IGNORE would be wrong because the plugin can legitimately fire on forgotten embedded gear (industrial gateways, ancient firewall appliances still in service in OT enclaves), and those niches do warrant inventory action. Backlog-hygiene LOW captures that cleanly.

1. Inventory and retire the affected appliance — If 11057 fires, the underlying device is almost certainly EOL Raptor, NetWare, or similar legacy gear. Replace it; there is no LTS branch to pull from. Treat this as backlog hygiene — no mitigation SLA, no remediation SLA beyond the 365-day window.
2. Enforce BCP38 ingress filtering and uRPF at edges — Already standard practice, but explicitly verify the path between any internet egress and the device flagged by 11057. This breaks step 3 of the chain regardless of ISN entropy.
3. Front legacy services with a modern TLS terminator or IPsec tunnel — If decommissioning is blocked by OT / contractual constraints, isolate the device behind a jump host or VPN concentrator that adds cryptographic session integrity. Source-IP trust dies; ISN entropy stops mattering.
4. Disable management protocols that rely on source-IP trust — rlogin, rsh, unauthenticated SNMP-set, and bare TCP RPC channels are the only application-layer payoffs for an ISN spoof. Turn them off on the flagged device and use SSH or out-of-band only.

Run from your auditor workstation (or a scan jump-host) against the flagged target. Requires nmap and root (raw sockets). Example: sudo ./check-isn.sh 10.0.12.34 443. Outputs VULNERABLE, PATCHED, or UNKNOWN based on Nmap's TCP sequence-predictability class.

#!/usr/bin/env bash
# noisgate verification for tenable:11057 / CVE-2002-1463
# Uses Nmap's TCP Sequence Prediction heuristic to classify ISN entropy.
set -u

TARGET="${1:-}"
PORT="${2:-80}"

if [[ -z "$TARGET" ]]; then
  echo "usage: $0 <target> [port]" >&2
  exit 2
fi

if ! command -v nmap >/dev/null 2>&1; then
  echo "UNKNOWN: nmap not installed" >&2
  exit 3
fi

if [[ $EUID -ne 0 ]]; then
  echo "UNKNOWN: must run as root for raw-socket OS detection" >&2
  exit 3
fi

# -O forces OS detection which emits the TCP Sequence Prediction line.
OUT=$(nmap -O -p "$PORT" -Pn --osscan-guess "$TARGET" 2>/dev/null)

SEQLINE=$(echo "$OUT" | grep -i "TCP Sequence Prediction")
if [[ -z "$SEQLINE" ]]; then
  echo "UNKNOWN: nmap returned no sequence prediction data"
  exit 3
fi

# Nmap difficulty classes: "trivial joke", "easy", "medium", "formidable",
# "worthy challenge", "good luck!"  Anything below 'formidable' is weak.
if echo "$SEQLINE" | grep -Eiq "trivial|easy|medium|random positive increments"; then
  echo "VULNERABLE: $SEQLINE"
  exit 1
fi

if echo "$SEQLINE" | grep -Eiq "formidable|worthy challenge|good luck"; then
  echo "PATCHED: $SEQLINE"
  exit 0
fi

echo "UNKNOWN: unparsed nmap output -> $SEQLINE"
exit 3

Sources

1. Tenable plugin 11057
2. NVD — CVE-2002-1463
3. MITRE — CVE-2002-1463
4. SecurityFocus BID 5387 (archived)
5. Michal Zalewski — Strange Attractors and TCP/IP Sequence Number Analysis
6. RFC 6528 — Defending Against Sequence Number Attacks
7. BCP 38 / RFC 2827 — Network Ingress Filtering
8. CISA KEV catalog