Lucene search

[email protected]NVD:CVE-2021-31888

HistoryNov 09, 2021 - 12:15 p.m.

CVE-2021-31888

2021-11-0912:15:09

CWE-170

CWE-787

[email protected]

web.nvd.nist.gov

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.003 Low

EPSS

Percentile

69.7%

JSON

A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.4), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.19), APOGEE PXC Modular (BACnet) (All versions < V3.5.4), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.19), Desigo PXC00-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC00-U (All versions >= V2.3 and < V6.30.016), Desigo PXC001-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC100-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC12-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC128-U (All versions >= V2.3 and < V6.30.016), Desigo PXC200-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC22-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC22.1-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC36.1-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC50-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC64-U (All versions >= V2.3 and < V6.30.016), Desigo PXM20-E (All versions >= V2.3 and < V6.30.016), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.4), Nucleus Source Code (All versions), TALON TC Compact (BACnet) (All versions < V3.5.4), TALON TC Modular (BACnet) (All versions < V3.5.4). FTP server does not properly validate the length of the “MKD/XMKD” command, leading to stack-based buffer overflows. This may result in Denial-of-Service conditions and Remote Code Execution. (FSMD-2021-0018)

Affected configurations

NVD

Node

siemensnucleus_net

siemensnucleus_readystart_v3Range<2017.02.4

siemensnucleus_source_code

Node

siemensapogee_modular_building_controller_firmware

AND

siemensapogee_modular_building_controllerMatch-

Node

siemensapogee_modular_equiment_controller_firmware

AND

siemensapogee_modular_equiment_controllerMatch-

Node

siemensapogee_pxc_compact_firmwareRange<2.8.19p2_ethernet

siemensapogee_pxc_compact_firmwareRange<3.5.4bacnet

AND

siemensapogee_pxc_compactMatch-

Node

siemensapogee_pxc_modular_firmwareRange<2.8.19p2_ethernet

siemensapogee_pxc_modular_firmwareRange<3.5.4bacnet

AND

siemensapogee_pxc_modularMatch-

Node

siemenstalon_tc_compact_firmwareRange<3.5.4

AND

siemenstalon_tc_compactMatch-

Node

siemenstalon_tc_modular_firmwareRange<3.5.4

AND

siemenstalon_tc_modularMatch-

Node

siemensdesigo_pxc00-e.d_firmwareRange2.3–6.30.016

AND

siemensdesigo_pxc00-e.dMatch-

Node

siemensdesigo_pxc00-u_firmwareRange2.3–6.30.016

AND

siemensdesigo_pxc00-uMatch-

Node

siemensdesigo_pxc001-e.d_firmwareRange2.3–6.30.016

AND

siemensdesigo_pxc001-e.dMatch-

Node

siemensdesigo_pxc12-e.d_firmwareRange2.3–6.30.016

AND

siemensdesigo_pxc12-e.dMatch-

Node

siemensdesigo_pxc22-e.d_firmwareRange2.3–6.30.016

AND

siemensdesigo_pxc22-e.dMatch-

Node

siemensdesigo_pxc22.1-e.d_firmwareRange2.3–6.30.016

AND

siemensdesigo_pxc22.1-e.dMatch-

Node

siemensdesigo_pxc36.1-e.d_firmwareRange2.3–6.30.016

AND

siemensdesigo_pxc36.1-e.dMatch-

Node

siemensdesigo_pxc50-e.d_firmwareRange2.3–6.30.016

AND

siemensdesigo_pxc50-e.dMatch-

Node

siemensdesigo_pxc64-u_firmwareRange2.3–6.30.016

AND

siemensdesigo_pxc64-uMatch-

Node

siemensdesigo_pxc100-e.d_firmwareRange2.3–6.30.016

AND

siemensdesigo_pxc100-e.dMatch-

Node

siemensdesigo_pxc128-u_firmwareRange2.3–6.30.016

AND

siemensdesigo_pxc128-uMatch-

Node

siemensdesigo_pxc200-e.d_firmwareRange2.3–6.30.016

AND

siemensdesigo_pxc200-e.dMatch-

Node

siemensdesigo_pxm20-e_firmwareRange2.3–6.30.016

AND

siemensdesigo_pxm20-eMatch-

References

cert-portal.siemens.com/productcert/pdf/ssa-044112.pdf

cert-portal.siemens.com/productcert/pdf/ssa-114589.pdf

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.003 Low

EPSS

Percentile

69.7%

JSON

Related for NVD:CVE-2021-31888

cvelist1 cve1 cnvd1 prion1 nessus14 thn1 f51 ics2 malwarebytes1