Sign-up

ID

VAR-202111-1615


CVE

CVE-2021-31889


TITLE

Siemens Nucleus Digital error vulnerability

Trust: 0.6

sources: CNNVD: CNNVD-202111-837

DESCRIPTION

A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.4), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.19), APOGEE PXC Modular (BACnet) (All versions < V3.5.4), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.19), Capital VSTAR (All versions with enabled Ethernet options), Desigo PXC00-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC00-U (All versions >= V2.3 and < V6.30.016), Desigo PXC001-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC100-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC12-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC128-U (All versions >= V2.3 and < V6.30.016), Desigo PXC200-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC22-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC22.1-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC36.1-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC50-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC64-U (All versions >= V2.3 and < V6.30.016), Desigo PXM20-E (All versions >= V2.3 and < V6.30.016), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.4), Nucleus Source Code (All versions), PLUSCONTROL 1st Gen (All versions), SIMOTICS CONNECT 400 (All versions < V0.5.0.0), TALON TC Compact (BACnet) (All versions < V3.5.4), TALON TC Modular (BACnet) (All versions < V3.5.4). Malformed TCP packets with a corrupted SACK option leads to Information Leaks and Denial-of-Service conditions. (FSMD-2021-0015)

Trust: 1.0

sources: NVD: CVE-2021-31889

AFFECTED PRODUCTS

vendor:siemensmodel:capital vstarscope:eqversion:*

Trust: 1.0

vendor:siemensmodel:apogee pxc compactscope:eqversion:*

Trust: 1.0

vendor:siemensmodel:nucleus source codescope:eqversion:*

Trust: 1.0

vendor:siemensmodel:talon tc compactscope:eqversion:*

Trust: 1.0

vendor:siemensmodel:apogee pxc modularscope:eqversion:*

Trust: 1.0

vendor:siemensmodel:talon tc modularscope:eqversion:*

Trust: 1.0

vendor:siemensmodel:nucleus netscope:eqversion:*

Trust: 1.0

vendor:siemensmodel:apogee modular equiment controllerscope:eqversion:*

Trust: 1.0

vendor:siemensmodel:apogee modular building controllerscope:eqversion:*

Trust: 1.0

vendor:siemensmodel:nucleus readystart v3scope:ltversion:2017.02.3

Trust: 1.0

sources: NVD: CVE-2021-31889

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-31889
value: CRITICAL

Trust: 1.0

CNNVD: CNNVD-202111-837
value: CRITICAL

Trust: 0.6

nvd@nist.gov: CVE-2021-31889
severity: MEDIUM
baseScore: 6.4
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

nvd@nist.gov: CVE-2021-31889
baseSeverity: CRITICAL
baseScore: 9.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.2
version: 3.1

Trust: 1.0

sources: CNNVD: CNNVD-202111-837 // NVD: CVE-2021-31889

PROBLEMTYPE DATA

problemtype:CWE-191

Trust: 1.0

sources: NVD: CVE-2021-31889

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202111-837

TYPE

digital error

Trust: 0.6

sources: CNNVD: CNNVD-202111-837

PATCH

title:siemens Nucleus Fixes for digital error vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=185268

Trust: 0.6

sources: CNNVD: CNNVD-202111-837

EXTERNAL IDS

db:NVDid:CVE-2021-31889

Trust: 1.6

db:SIEMENSid:SSA-620288

Trust: 1.6

db:SIEMENSid:SSA-044112

Trust: 1.6

db:SIEMENSid:SSA-845392

Trust: 1.6

db:SIEMENSid:SSA-223353

Trust: 1.6

db:SIEMENSid:SSA-114589

Trust: 1.6

db:AUSCERTid:ESB-2022.0094

Trust: 0.6

db:AUSCERTid:ESB-2021.3874

Trust: 0.6

db:AUSCERTid:ESB-2021.4289

Trust: 0.6

db:AUSCERTid:ESB-2021.3833

Trust: 0.6

db:ICS CERTid:ICSA-22-013-03

Trust: 0.6

db:ICS CERTid:ICSA-22-069-02

Trust: 0.6

db:ICS CERTid:ICSA-21-350-06

Trust: 0.6

db:ICS CERTid:ICSA-21-313-03

Trust: 0.6

db:ICS CERTid:ICSA-21-315-07

Trust: 0.6

db:CS-HELPid:SB2021111003

Trust: 0.6

db:CS-HELPid:SB2021121648

Trust: 0.6

db:CS-HELPid:SB2022011803

Trust: 0.6

db:CS-HELPid:SB2022031014

Trust: 0.6

db:CS-HELPid:SB2022010910

Trust: 0.6

db:CNNVDid:CNNVD-202111-837

Trust: 0.6

sources: CNNVD: CNNVD-202111-837 // NVD: CVE-2021-31889

REFERENCES

url:https://cert-portal.siemens.com/productcert/pdf/ssa-845392.pdf

Trust: 1.6

url:https://cert-portal.siemens.com/productcert/pdf/ssa-044112.pdf

Trust: 1.6

url:https://cert-portal.siemens.com/productcert/pdf/ssa-114589.pdf

Trust: 1.6

url:https://cert-portal.siemens.com/productcert/pdf/ssa-223353.pdf

Trust: 1.6

url:https://cert-portal.siemens.com/productcert/pdf/ssa-620288.pdf

Trust: 1.6

url:https://www.cybersecurity-help.cz/vdb/sb2021111003

Trust: 0.6

url:https://source.android.com/security/bulletin/2022-01-01

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.0094

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.3833

Trust: 0.6

url:https://us-cert.cisa.gov/ics/advisories/icsa-22-069-02

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.3874

Trust: 0.6

url:https://vigilance.fr/vulnerability/google-android-pixel-multiple-vulnerabilities-of-january-2022-37172

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.4289

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022011803

Trust: 0.6

url:https://us-cert.cisa.gov/ics/advisories/icsa-22-013-03

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2021121648

Trust: 0.6

url:https://us-cert.cisa.gov/ics/advisories/icsa-21-315-07

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022010910

Trust: 0.6

url:https://us-cert.cisa.gov/ics/advisories/icsa-21-350-06

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022031014

Trust: 0.6

url:https://us-cert.cisa.gov/ics/advisories/icsa-21-313-03

Trust: 0.6

sources: CNNVD: CNNVD-202111-837 // NVD: CVE-2021-31889

CREDITS

Siemens reported these vulnerabilities to CISA.

Trust: 0.6

sources: CNNVD: CNNVD-202111-837

SOURCES

db:CNNVDid:CNNVD-202111-837
db:NVDid:CVE-2021-31889

LAST UPDATE DATE

2024-08-14T12:54:16.504000+00:00


SOURCES UPDATE DATE

db:CNNVDid:CNNVD-202111-837date:2022-05-23T00:00:00
db:NVDid:CVE-2021-31889date:2022-05-20T13:15:13.307

SOURCES RELEASE DATE

db:CNNVDid:CNNVD-202111-837date:2021-11-09T00:00:00
db:NVDid:CVE-2021-31889date:2021-11-09T12:15:09.693