CVE-2021-31890 Denial of service in Capital Embedded AR Classic 431-422
Attackers can cause denial of service or information leaks by sending malformed TCP payloads to Siemens industrial devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-31890?
CVE-2021-31890 is a high-severity denial of service vulnerability in Siemens Capital Embedded AR Classic 431-422, published on 9 Nov 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), PLUSCONTROL 1st Gen (All versions), SIMOTICS CONNECT 400 (All versions < V0.5.0.0), SIMOTICS CONNECT 400 (All versions < V1.0.0.0). The total length of an TCP payload (set in the IP header) is unchecked. This may lead to various side effects, including Information Leak and Denial-of-Service conditions, depending on the network buffer organization in memory. (FSMD-2021-0017)
Weakness: CWE-240
Which versions are affected by CVE-2021-31890?
It affects 11 products.
Products include Siemens Apogee Modular Building Controller Firmware, Siemens Apogee Modular Equiment Controller Firmware, Siemens Apogee Pxc Compact Firmware, Siemens Apogee Pxc Modular Firmware, Siemens Capital Vstar, Siemens Nucleus Net and 5 more.
How do I fix CVE-2021-31890?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-31890 being exploited?
There is no known exploitation of CVE-2021-31890 in the wild and no public exploit code.
Other vulnerabilities in Siemens Capital Embedded AR Classic 431-422
- CVE-2021-31884 Memory corruption in APOGEE MBC (PPC) (BACnet)
- CVE-2021-31886 Memory corruption in APOGEE MBC (PPC) (BACnet)
- CVE-2021-31887 Memory corruption in APOGEE MBC (PPC) (BACnet)
- CVE-2021-31888 Memory corruption in APOGEE MBC (PPC) (BACnet)
- CVE-2022-38371 Denial of service in APOGEE MBC (PPC) (BACnet)
Sources
Also known as GHSA-4mmq-7ch6-8958.