Details of VAR-202111-1613

ID

VAR-202111-1613

CVE

CVE-2021-31344

TITLE

Siemens Nucleus ReadyStart Security hole

Trust: 0.6

sources: CNNVD: CNNVD-202111-855

DESCRIPTION

A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.4), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.19), APOGEE PXC Modular (BACnet) (All versions < V3.5.4), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.19), Capital VSTAR (All versions with enabled Ethernet options), Desigo PXC00-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC00-U (All versions >= V2.3 and < V6.30.016), Desigo PXC001-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC100-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC12-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC128-U (All versions >= V2.3 and < V6.30.016), Desigo PXC200-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC22-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC22.1-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC36.1-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC50-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC64-U (All versions >= V2.3 and < V6.30.016), Desigo PXM20-E (All versions >= V2.3 and < V6.30.016), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.4), Nucleus ReadyStart V4 (All versions < V4.1.1), Nucleus Source Code (All versions), PLUSCONTROL 1st Gen (All versions), SIMOTICS CONNECT 400 (All versions < V0.5.0.0), TALON TC Compact (BACnet) (All versions < V3.5.4), TALON TC Modular (BACnet) (All versions < V3.5.4). ICMP echo packets with fake IP options allow sending ICMP echo reply messages to arbitrary hosts on the network. (FSMD-2021-0004)

Trust: 1.0

sources: NVD: CVE-2021-31344

AFFECTED PRODUCTS

vendor:	siemens	model:	nucleus readystart v4	scope:	lt	version:	4.1.1	Trust: 1.0
vendor:	siemens	model:	capital vstar	scope:	eq	version:	*	Trust: 1.0
vendor:	siemens	model:	apogee pxc compact	scope:	eq	version:	*	Trust: 1.0
vendor:	siemens	model:	nucleus source code	scope:	eq	version:	*	Trust: 1.0
vendor:	siemens	model:	talon tc compact	scope:	eq	version:	*	Trust: 1.0
vendor:	siemens	model:	nucleus readystart v3	scope:	lt	version:	2017.02.1	Trust: 1.0
vendor:	siemens	model:	apogee pxc modular	scope:	eq	version:	*	Trust: 1.0
vendor:	siemens	model:	talon tc modular	scope:	eq	version:	*	Trust: 1.0
vendor:	siemens	model:	nucleus net	scope:	eq	version:	*	Trust: 1.0
vendor:	siemens	model:	apogee modular equiment controller	scope:	eq	version:	*	Trust: 1.0
vendor:	siemens	model:	apogee modular building controller	scope:	eq	version:	*	Trust: 1.0

sources: NVD: CVE-2021-31344

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2021-31344
value:	MEDIUM
Trust: 1.0
CNNVD:	CNNVD-202111-855
value:	MEDIUM
Trust: 0.6

nvd@nist.gov:	CVE-2021-31344
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0

nvd@nist.gov:	CVE-2021-31344
baseSeverity:	MEDIUM
baseScore:	5.3
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	1.4
version:	3.1
Trust: 1.0

sources: CNNVD: CNNVD-202111-855 // NVD: CVE-2021-31344

PROBLEMTYPE DATA

problemtype:

CWE-843

Trust: 1.0

sources: NVD: CVE-2021-31344

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202111-855

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202111-855

PATCH

title:

Siemens Nucleus ReadyStart Security vulnerabilities

url:

http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=178543

Trust: 0.6

sources: CNNVD: CNNVD-202111-855

EXTERNAL IDS

db:	NVD	id:	CVE-2021-31344	Trust: 1.6
db:	SIEMENS	id:	SSA-620288	Trust: 1.6
db:	SIEMENS	id:	SSA-044112	Trust: 1.6
db:	SIEMENS	id:	SSA-845392	Trust: 1.6
db:	SIEMENS	id:	SSA-223353	Trust: 1.6
db:	SIEMENS	id:	SSA-114589	Trust: 1.6
db:	ICS CERT	id:	ICSA-21-350-06	Trust: 0.6
db:	ICS CERT	id:	ICSA-21-313-03	Trust: 0.6
db:	ICS CERT	id:	ICSA-21-315-07	Trust: 0.6
db:	ICS CERT	id:	ICSA-22-013-03	Trust: 0.6
db:	ICS CERT	id:	ICSA-22-069-02	Trust: 0.6
db:	CS-HELP	id:	SB2021121648	Trust: 0.6
db:	CS-HELP	id:	SB2022031013	Trust: 0.6
db:	CS-HELP	id:	SB2021111003	Trust: 0.6
db:	CS-HELP	id:	SB2022011803	Trust: 0.6
db:	AUSCERT	id:	ESB-2021.3874	Trust: 0.6
db:	AUSCERT	id:	ESB-2021.4289	Trust: 0.6
db:	AUSCERT	id:	ESB-2021.3833	Trust: 0.6
db:	CNNVD	id:	CNNVD-202111-855	Trust: 0.6

sources: CNNVD: CNNVD-202111-855 // NVD: CVE-2021-31344

REFERENCES

url:	https://cert-portal.siemens.com/productcert/pdf/ssa-845392.pdf	Trust: 1.6
url:	https://cert-portal.siemens.com/productcert/pdf/ssa-044112.pdf	Trust: 1.6
url:	https://cert-portal.siemens.com/productcert/pdf/ssa-114589.pdf	Trust: 1.6
url:	https://cert-portal.siemens.com/productcert/pdf/ssa-223353.pdf	Trust: 1.6
url:	https://cert-portal.siemens.com/productcert/pdf/ssa-620288.pdf	Trust: 1.6
url:	https://www.cybersecurity-help.cz/vdb/sb2021111003	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/esb-2021.3833	Trust: 0.6
url:	https://us-cert.cisa.gov/ics/advisories/icsa-22-069-02	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/esb-2021.3874	Trust: 0.6
url:	https://nvd.nist.gov/vuln/detail/cve-2021-31344	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/esb-2021.4289	Trust: 0.6
url:	https://www.cybersecurity-help.cz/vdb/sb2022011803	Trust: 0.6
url:	https://us-cert.cisa.gov/ics/advisories/icsa-22-013-03	Trust: 0.6
url:	https://www.cybersecurity-help.cz/vdb/sb2021121648	Trust: 0.6
url:	https://us-cert.cisa.gov/ics/advisories/icsa-21-315-07	Trust: 0.6
url:	https://us-cert.cisa.gov/ics/advisories/icsa-21-350-06	Trust: 0.6
url:	https://www.cybersecurity-help.cz/vdb/sb2022031013	Trust: 0.6
url:	https://us-cert.cisa.gov/ics/advisories/icsa-21-313-03	Trust: 0.6

sources: CNNVD: CNNVD-202111-855 // NVD: CVE-2021-31344

CREDITS

Siemens reported these vulnerabilities to CISA.

Trust: 0.6

sources: CNNVD: CNNVD-202111-855

SOURCES

db:	CNNVD	id:	CNNVD-202111-855
db:	NVD	id:	CVE-2021-31344

LAST UPDATE DATE

2024-08-14T12:47:47.480000+00:00

SOURCES UPDATE DATE

db:	CNNVD	id:	CNNVD-202111-855	date:	2022-05-23T00:00:00
db:	NVD	id:	CVE-2021-31344	date:	2022-05-20T13:15:12.027

SOURCES RELEASE DATE

db:	CNNVD	id:	CNNVD-202111-855	date:	2021-11-09T00:00:00
db:	NVD	id:	CVE-2021-31344	date:	2021-11-09T12:15:09.087