CVE-2021-25217
lowPriorität · verfolgen · 15EPSS 0.061 · 93. PerzentilDEEURUUSEPSS · bewertet 2026-10-26
In ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16, ISC DHCP 4.4.0 -> 4.4.2 (Other branches of ISC DHCP (i.e., releases in the 4.0.x series or lower and releases in the 4.3.x series) are beyond their End-of-Life (EOL) and no longer supported by ISC. From inspection it is clear that the defect is also present in releases from those series, but they have not been officially tested for the vulnerability), The outcome of encountering the defect while reading a lease that will trigger it varies, according to: the component being affected (i.e., dhclient or dhcpd) whether the package was built as a 32-bit or 64-bit binary whether the compiler flag -fstack-protection-strong was used when compiling In dhclient, ISC has not successfully reproduced the error on a 64-bit system. However, on a 32-bit system it is possible to cause dhclient to crash when reading an improper lease, which could cause network connectivity problems for an affected system due to the absence of a running DHCP client process. In dhcpd, when run in DHCPv4 or DHCPv6 mode: if the dhcpd server binary was built for a 32-bit architecture AND the -fstack-protection-strong flag was specified to the compiler, dhcpd may exit while parsing a lease file containing an objectionable lease, resulting in lack of service to clients. Additionally, the offending lease and the lease immediately following it in the lease database may be improperly deleted. if the dhcpd server binary was built for a 64-bit architecture OR if the -fstack-protection-strong compiler flag was NOT specified, the crash will not occur, but it is possible for the offending lease and the lease which immediately followed it to be improperly deleted.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- BehobenRUGGEDCOM ROX MX5000siemens_psirt
Update to V2.15.0 or later version
https://support.industry.siemens.com/cs/document/109805782/ - BehobenRUGGEDCOM ROX RX1400siemens_psirt
Update to V2.15.0 or later version
https://support.industry.siemens.com/cs/document/109805782/ - BehobenRUGGEDCOM ROX RX1500siemens_psirt
Update to V2.15.0 or later version
https://support.industry.siemens.com/cs/document/109805782/ - BehobenRUGGEDCOM ROX RX1501siemens_psirt
Update to V2.15.0 or later version
https://support.industry.siemens.com/cs/document/109805782/ - BehobenRUGGEDCOM ROX RX1510siemens_psirt
Update to V2.15.0 or later version
https://support.industry.siemens.com/cs/document/109805782/ - BehobenRUGGEDCOM ROX RX1511siemens_psirt
Update to V2.15.0 or later version
https://support.industry.siemens.com/cs/document/109805782/ - BehobenRUGGEDCOM ROX RX1512siemens_psirt
Update to V2.15.0 or later version
https://support.industry.siemens.com/cs/document/109805782/ - BehobenRUGGEDCOM ROX RX1524siemens_psirt
Update to V2.15.0 or later version
https://support.industry.siemens.com/cs/document/109805782/ - BehobenRUGGEDCOM ROX RX1536siemens_psirt
Update to V2.15.0 or later version
https://support.industry.siemens.com/cs/document/109805782/ - BehobenRUGGEDCOM ROX RX5000siemens_psirt
Update to V2.15.0 or later version
https://support.industry.siemens.com/cs/document/109805782/ - BehobenSINEC INSsiemens_psirt
Update to V1.0 SP2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812610/ - BehobenSINEC INScisa_csaf_ot
Update to V1.0 SP2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812610/ - WorkaroundSICK TDC-E210GC all Firmware versionssick_psirt
Please make sure that only trusted entities have access to the device. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk. The collected resources "SICK Operating Guidelines" and "ICS-CERT recommended practices on Industrial Security" could help to implement the general security practices.
- WorkaroundEndress+Hauser SSG-E210GC all Firmware versionssick_psirt
Please make sure that only trusted entities have access to the device. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk. The collected resources "SICK Operating Guidelines" and "ICS-CERT recommended practices on Industrial Security" could help to implement the general security practices.
- WorkaroundRUGGEDCOM ROX MX5000siemens_psirt
Disable the DHCP client if not needed for operations
- WorkaroundRUGGEDCOM ROX RX1400siemens_psirt
Disable the DHCP client if not needed for operations
- WorkaroundRUGGEDCOM ROX RX1500siemens_psirt
Disable the DHCP client if not needed for operations
- WorkaroundRUGGEDCOM ROX RX1501siemens_psirt
Disable the DHCP client if not needed for operations
- WorkaroundRUGGEDCOM ROX RX1510siemens_psirt
Disable the DHCP client if not needed for operations
- WorkaroundRUGGEDCOM ROX RX1511siemens_psirt
Disable the DHCP client if not needed for operations
- WorkaroundRUGGEDCOM ROX RX1512siemens_psirt
Disable the DHCP client if not needed for operations
- WorkaroundRUGGEDCOM ROX RX1524siemens_psirt
Disable the DHCP client if not needed for operations
- WorkaroundRUGGEDCOM ROX RX1536siemens_psirt
Disable the DHCP client if not needed for operations
- WorkaroundRUGGEDCOM ROX RX5000siemens_psirt
Disable the DHCP client if not needed for operations
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · low–high · 2.8–8.8
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (54)
Betroffene Produkte und Versionsbereiche.
- Juniper Contrail Service Orchestrationalle Versionencert_bundDEcpe:/a:juniper:contrail_service_orchestration:-
Advisories (7)
Hersteller- und Ökosystem-Meldungen dazu.
- SCA-2025-0009Vulnerabilities affecting SICK TDC-E210GC2025-08-01csaf · sick_psirtDE
SICK has identified multiple vulnerabilities in the SICK TDC-E210GC product. The advisory includes a total of 23 vulnerabilities, of which 14 are confirmed as affected and 9 as known not affected. At this time, SICK is not aware of any public exploits specifically targeting these vulnerabilities. Customers are strongly advised to apply the recommended workaround for the affected vulnerabilities to reduce potential risk.
- SCA-2025-0011Vulnerabilities affecting Endress+Hauser SSG-E210GC2025-10-02csaf · sick_psirtDE
Several vulnerabilities in the Endress+Hauser SSG-E210GC product were discoverd. The advisory includes a total of 23 vulnerabilities, of which 14 are confirmed as affected and 9 as known not affected.
- SSA-406691SSA-406691: Buffer Vulnerabilities in DHCP function of RUGGEDCOM ROX products2022-03-08csaf · siemens_psirtDE
A vulnerability in the RUGGEDCOM ROX devices' third party component, ISC DHCP, could allow an attacker to cause a buffer overrun due to a bug when reading a stored DHCP lease containing certain option information, eventually leading to a denial-of-service condition, or cause a remote-code execution. Siemens has released updates for the affected products and recommends to update to the latest versions.
- SSA-637483SSA-637483 Third-Party Component Vulnerabilities in SINEC INS before V1.0 SP22022-09-13csaf · siemens_psirtDE
Multiple vulnerabilities affecting various third-party components of SINEC INS before V1.0 SP2 could allow an attacker to cause a denial of service condition, disclose sensitive data or violate the system integrity. Siemens has released an update for the SINEC INS and recommends to update to the latest version.
- WID-SEC-W-2023-0063Juniper Junos Space: Mehrere SchwachstellenDeutsch2022-01-12csaf · cert_bundDE
Ein Angreifer aus dem angrenzenden Netzwerk oder ein entfernter anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in Juniper Junos Space ausnutzen, um Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand auszulösen, beliebigen Code auszuführen und seine Privilegien zu erweitern.
- WID-SEC-W-2023-1261Internet Systems Consortium DHCP: Schwachstelle ermöglicht Denial of ServiceDeutsch2021-05-26csaf · cert_bundDE
Ein Angreifer aus dem benachbarten Netzwerk kann eine Schwachstelle in Internet Systems Consortium DHCP ausnutzen, um einen Denial of Service Angriff durchzuführen.
- ICSA-22-258-05Siemens SINEC INS2022-09-13icsa · cisa_csaf_otUS
Multiple vulnerabilities affecting various third-party components of SINEC INS before V1.0 SP2 could allow an attacker to cause a denial of service condition, disclose sensitive data or violate the system integrity. Siemens has released an update for the SINEC INS and recommends to update to the latest version.
auch bekannt als (4)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (59)
Externe Belege — Patches, Meldungen, Analysen.
- http://www.openwall.com/lists/oss-security/2021/05/26/6cnnvd
- https://access.redhat.com/security/cve/cve-2021-25217cnnvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-406691.pdfcnnvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdfcnnvd
- https://kb.isc.org/docs/cve-2021-25217cnnvd
- https://lists.debian.org/debian-lts-announce/2021/06/msg00002.htmlcnnvd
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5QI4DYC7J4BGHEW3NH4XHMWTHYC36UK4/cnnvd
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z2LB42JWIV4M4WDNXX5VGIP26FEYWKIF/cnnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan