Vulnerabilities > CVE-2021-31346 - Improper Validation of Specified Quantity in Input vulnerability in Siemens products

CVSS 6.4 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

PARTIAL

Integrity impact

NONE

Availability impact

PARTIAL

network

low complexity

siemens

CWE-1284

NVD

Published: 2021-11-09

Updated: 2022-05-20

Summary

A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.4), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.19), APOGEE PXC Modular (BACnet) (All versions < V3.5.4), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.19), Capital VSTAR (All versions with enabled Ethernet options), Desigo PXC00-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC00-U (All versions >= V2.3 and < V6.30.016), Desigo PXC001-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC100-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC12-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC128-U (All versions >= V2.3 and < V6.30.016), Desigo PXC200-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC22-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC22.1-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC36.1-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC50-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC64-U (All versions >= V2.3 and < V6.30.016), Desigo PXM20-E (All versions >= V2.3 and < V6.30.016), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.4), Nucleus ReadyStart V4 (All versions < V4.1.1), Nucleus Source Code (All versions), PLUSCONTROL 1st Gen (All versions), SIMOTICS CONNECT 400 (All versions < V0.5.0.0), TALON TC Compact (BACnet) (All versions < V3.5.4), TALON TC Modular (BACnet) (All versions < V3.5.4). The total length of an ICMP payload (set in the IP header) is unchecked. This may lead to various side effects, including Information Leak and Denial-of-Service conditions, depending on the network buffer organization in memory. (FSMD-2021-0007)

Vulnerable Configurations

Part	Description	Count
Application	Siemens Siemens Nucleus Source Code * Siemens Nucleus NET * Siemens Capital Vstar * Siemens Nucleus Readystart V4 4.1.0 Siemens Nucleus Readystart V3 2013.08	5
OS	Siemens Siemens Apogee Modular Building Controller Firmware * Siemens Apogee Modular Equiment Controller Firmware * Siemens Apogee PXC Compact Firmware * Siemens Apogee PXC Modular Firmware * Siemens Talon TC Compact Firmware * Siemens Talon TC Modular Firmware *	6
Hardware	Siemens Siemens Apogee Modular Building Controller - Siemens Apogee Modular Equiment Controller - Siemens Apogee PXC Compact - Siemens Apogee PXC Modular - Siemens Talon TC Compact - Siemens Talon TC Modular -	6

Common Weakness Enumeration (CWE)

CWE-1284 - Improper Validation of Specified Quantity in Input

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References