Sign-up

ID

VAR-202111-1611


CVE

CVE-2021-31346


TITLE

Siemens Nucleus Security hole

Trust: 0.6

sources: CNNVD: CNNVD-202111-851

DESCRIPTION

A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.4), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.19), APOGEE PXC Modular (BACnet) (All versions < V3.5.4), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.19), Capital VSTAR (All versions with enabled Ethernet options), Desigo PXC00-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC00-U (All versions >= V2.3 and < V6.30.016), Desigo PXC001-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC100-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC12-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC128-U (All versions >= V2.3 and < V6.30.016), Desigo PXC200-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC22-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC22.1-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC36.1-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC50-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC64-U (All versions >= V2.3 and < V6.30.016), Desigo PXM20-E (All versions >= V2.3 and < V6.30.016), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.4), Nucleus ReadyStart V4 (All versions < V4.1.1), Nucleus Source Code (All versions), PLUSCONTROL 1st Gen (All versions), SIMOTICS CONNECT 400 (All versions < V0.5.0.0), TALON TC Compact (BACnet) (All versions < V3.5.4), TALON TC Modular (BACnet) (All versions < V3.5.4). The total length of an ICMP payload (set in the IP header) is unchecked. This may lead to various side effects, including Information Leak and Denial-of-Service conditions, depending on the network buffer organization in memory. (FSMD-2021-0007)

Trust: 1.0

sources: NVD: CVE-2021-31346

AFFECTED PRODUCTS

vendor:siemensmodel:nucleus readystart v4scope:ltversion:4.1.1

Trust: 1.0

vendor:siemensmodel:capital vstarscope:eqversion:*

Trust: 1.0

vendor:siemensmodel:apogee pxc compactscope:eqversion:*

Trust: 1.0

vendor:siemensmodel:nucleus source codescope:eqversion:*

Trust: 1.0

vendor:siemensmodel:talon tc compactscope:eqversion:*

Trust: 1.0

vendor:siemensmodel:nucleus readystart v3scope:ltversion:2017.02.1

Trust: 1.0

vendor:siemensmodel:apogee pxc modularscope:eqversion:*

Trust: 1.0

vendor:siemensmodel:talon tc modularscope:eqversion:*

Trust: 1.0

vendor:siemensmodel:nucleus netscope:eqversion:*

Trust: 1.0

vendor:siemensmodel:apogee modular equiment controllerscope:eqversion:*

Trust: 1.0

vendor:siemensmodel:apogee modular building controllerscope:eqversion:*

Trust: 1.0

sources: NVD: CVE-2021-31346

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-31346
value: CRITICAL

Trust: 1.0

CNNVD: CNNVD-202111-851
value: CRITICAL

Trust: 0.6

nvd@nist.gov: CVE-2021-31346
severity: MEDIUM
baseScore: 6.4
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

nvd@nist.gov: CVE-2021-31346
baseSeverity: CRITICAL
baseScore: 9.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.2
version: 3.1

Trust: 1.0

sources: CNNVD: CNNVD-202111-851 // NVD: CVE-2021-31346

PROBLEMTYPE DATA

problemtype:CWE-1284

Trust: 1.0

sources: NVD: CVE-2021-31346

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202111-851

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202111-851

PATCH

title:siemens Nucleus Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=185269

Trust: 0.6

sources: CNNVD: CNNVD-202111-851

EXTERNAL IDS

db:NVDid:CVE-2021-31346

Trust: 1.6

db:SIEMENSid:SSA-620288

Trust: 1.6

db:SIEMENSid:SSA-044112

Trust: 1.6

db:SIEMENSid:SSA-845392

Trust: 1.6

db:SIEMENSid:SSA-223353

Trust: 1.6

db:SIEMENSid:SSA-114589

Trust: 1.6

db:AUSCERTid:ESB-2022.0094

Trust: 0.6

db:AUSCERTid:ESB-2021.3874

Trust: 0.6

db:AUSCERTid:ESB-2021.4289

Trust: 0.6

db:AUSCERTid:ESB-2021.3833

Trust: 0.6

db:ICS CERTid:ICSA-22-013-03

Trust: 0.6

db:ICS CERTid:ICSA-22-069-02

Trust: 0.6

db:ICS CERTid:ICSA-21-350-06

Trust: 0.6

db:ICS CERTid:ICSA-21-313-03

Trust: 0.6

db:ICS CERTid:ICSA-21-315-07

Trust: 0.6

db:CS-HELPid:SB2022031013

Trust: 0.6

db:CS-HELPid:SB2021111003

Trust: 0.6

db:CS-HELPid:SB2021121648

Trust: 0.6

db:CS-HELPid:SB2022011803

Trust: 0.6

db:CS-HELPid:SB2022010910

Trust: 0.6

db:CNNVDid:CNNVD-202111-851

Trust: 0.6

sources: CNNVD: CNNVD-202111-851 // NVD: CVE-2021-31346

REFERENCES

url:https://cert-portal.siemens.com/productcert/pdf/ssa-845392.pdf

Trust: 1.6

url:https://cert-portal.siemens.com/productcert/pdf/ssa-044112.pdf

Trust: 1.6

url:https://cert-portal.siemens.com/productcert/pdf/ssa-114589.pdf

Trust: 1.6

url:https://cert-portal.siemens.com/productcert/pdf/ssa-223353.pdf

Trust: 1.6

url:https://cert-portal.siemens.com/productcert/pdf/ssa-620288.pdf

Trust: 1.6

url:https://www.cybersecurity-help.cz/vdb/sb2021111003

Trust: 0.6

url:https://source.android.com/security/bulletin/2022-01-01

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.0094

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.3833

Trust: 0.6

url:https://nvd.nist.gov/vuln/detail/cve-2021-31346

Trust: 0.6

url:https://us-cert.cisa.gov/ics/advisories/icsa-22-069-02

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.3874

Trust: 0.6

url:https://vigilance.fr/vulnerability/google-android-pixel-multiple-vulnerabilities-of-january-2022-37172

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.4289

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022011803

Trust: 0.6

url:https://us-cert.cisa.gov/ics/advisories/icsa-22-013-03

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2021121648

Trust: 0.6

url:https://us-cert.cisa.gov/ics/advisories/icsa-21-315-07

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022010910

Trust: 0.6

url:https://us-cert.cisa.gov/ics/advisories/icsa-21-350-06

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022031013

Trust: 0.6

url:https://us-cert.cisa.gov/ics/advisories/icsa-21-313-03

Trust: 0.6

sources: CNNVD: CNNVD-202111-851 // NVD: CVE-2021-31346

CREDITS

Siemens reported these vulnerabilities to CISA.

Trust: 0.6

sources: CNNVD: CNNVD-202111-851

SOURCES

db:CNNVDid:CNNVD-202111-851
db:NVDid:CVE-2021-31346

LAST UPDATE DATE

2024-08-14T13:06:21.938000+00:00


SOURCES UPDATE DATE

db:CNNVDid:CNNVD-202111-851date:2022-05-23T00:00:00
db:NVDid:CVE-2021-31346date:2022-05-20T13:15:12.237

SOURCES RELEASE DATE

db:CNNVDid:CNNVD-202111-851date:2021-11-09T00:00:00
db:NVDid:CVE-2021-31346date:2021-11-09T12:15:09.200