CVE-2021-25667

mediumPriorität · verfolgen · 35EPSS 0.010 · 61. PerzentilDEEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.95% (61st) EPSS

CVSS 5.8 · medium

Is it mine?

84 products

Prüfe deine Angriffsfläche

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · bewertet 2026-10-26

A vulnerability has been identified in RUGGEDCOM RM1224 (All versions >= V4.3 and < V6.4), SCALANCE M-800 (All versions >= V4.3 and < V6.4), SCALANCE S615 (All versions >= V4.3 and < V6.4), SCALANCE SC-600 Family (All versions >= V2.0 and < V2.1.3), SCALANCE XB-200 (All versions < V4.1), SCALANCE XC-200 (All versions < V4.1), SCALANCE XF-200BA (All versions < V4.1), SCALANCE XM400 (All versions < V6.2), SCALANCE XP-200 (All versions < V4.1), SCALANCE XR-300WG (All versions < V4.1), SCALANCE XR500 (All versions < V6.2). Affected devices contain a stack-based buffer overflow vulnerability in the handling of STP BPDU frames that could allow a remote attacker to trigger a denial-of-service condition or potentially remote code execution. Successful exploitation requires the passive listening feature of the device to be active.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

BehobenRUGGEDCOM RM1224siemens_psirt
Update to V6.4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794349/
BehobenSCALANCE M-800siemens_psirt
Update to V6.4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794349/
BehobenSCALANCE S615siemens_psirt
Update to V6.4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794349/
BehobenSCALANCE SC-600 Familysiemens_psirt
Update to V2.1.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109793041/
BehobenSCALANCE XB-200siemens_psirt
Update to V4.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109762982/
BehobenSCALANCE XC-200siemens_psirt
Update to V4.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109762982/
BehobenSCALANCE XF-200BAsiemens_psirt
Update to V4.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109762982/
BehobenSCALANCE XM400siemens_psirt
Update to V6.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109764409/
BehobenSCALANCE XP-200siemens_psirt
Update to V4.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109762982/
BehobenSCALANCE XR-300WGsiemens_psirt
Update to V4.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109762982/
BehobenSCALANCE XR500siemens_psirt
Update to V6.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109761425/
BehobenRUGGEDCOM RM1224cisa_csaf_ot
Update to V6.4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794349/
BehobenSCALANCE M-800cisa_csaf_ot
Update to V6.4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794349/
BehobenSCALANCE S615cisa_csaf_ot
Update to V6.4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794349/
BehobenSCALANCE SC-600 Familycisa_csaf_ot
Update to V2.1.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109793041/
BehobenSCALANCE XB-200cisa_csaf_ot
Update to V4.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109762982/
BehobenSCALANCE XC-200cisa_csaf_ot
Update to V4.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109762982/
BehobenSCALANCE XF-200BAcisa_csaf_ot
Update to V4.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109762982/
BehobenSCALANCE XM400cisa_csaf_ot
Update to V6.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109764409/
BehobenSCALANCE XP-200cisa_csaf_ot
Update to V4.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109762982/
BehobenSCALANCE XR-300WGcisa_csaf_ot
Update to V4.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109762982/
BehobenSCALANCE XR500cisa_csaf_ot
Update to V6.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109761425/
MitigationRUGGEDCOM RM1224siemens_psirt
Deactivate the STP passive listening feature of the vulnerable devices
MitigationSCALANCE M-800siemens_psirt
Deactivate the STP passive listening feature of the vulnerable devices
MitigationSCALANCE S615siemens_psirt
Deactivate the STP passive listening feature of the vulnerable devices
MitigationSCALANCE SC-600 Familysiemens_psirt
Deactivate the STP passive listening feature of the vulnerable devices
MitigationSCALANCE XB-200siemens_psirt
Deactivate the STP passive listening feature of the vulnerable devices
MitigationSCALANCE XC-200siemens_psirt
Deactivate the STP passive listening feature of the vulnerable devices
MitigationSCALANCE XF-200BAsiemens_psirt
Deactivate the STP passive listening feature of the vulnerable devices
MitigationSCALANCE XM400siemens_psirt
Deactivate the STP passive listening feature of the vulnerable devices
MitigationSCALANCE XP-200siemens_psirt
Deactivate the STP passive listening feature of the vulnerable devices
MitigationSCALANCE XR-300WGsiemens_psirt
Deactivate the STP passive listening feature of the vulnerable devices
MitigationSCALANCE XR500siemens_psirt
Deactivate the STP passive listening feature of the vulnerable devices
MitigationRUGGEDCOM RM1224cisa_csaf_ot
Deactivate the STP passive listening feature of the vulnerable devices
MitigationSCALANCE M-800cisa_csaf_ot
Deactivate the STP passive listening feature of the vulnerable devices
MitigationSCALANCE S615cisa_csaf_ot
Deactivate the STP passive listening feature of the vulnerable devices
MitigationSCALANCE SC-600 Familycisa_csaf_ot
Deactivate the STP passive listening feature of the vulnerable devices
MitigationSCALANCE XB-200cisa_csaf_ot
Deactivate the STP passive listening feature of the vulnerable devices
MitigationSCALANCE XC-200cisa_csaf_ot
Deactivate the STP passive listening feature of the vulnerable devices
MitigationSCALANCE XF-200BAcisa_csaf_ot
Deactivate the STP passive listening feature of the vulnerable devices
MitigationSCALANCE XM400cisa_csaf_ot
Deactivate the STP passive listening feature of the vulnerable devices
MitigationSCALANCE XP-200cisa_csaf_ot
Deactivate the STP passive listening feature of the vulnerable devices
MitigationSCALANCE XR-300WGcisa_csaf_ot
Deactivate the STP passive listening feature of the vulnerable devices
MitigationSCALANCE XR500cisa_csaf_ot
Deactivate the STP passive listening feature of the vulnerable devices

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

8.8

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 5.8–8.8

v2.05.8mediumAV:A/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USAusnutzbarkeit 6.5 · Auswirkung 6.4

v3.18.8highCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 2.8 · Auswirkung 5.9

v3.18.8highCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:Csecondary · CISA US

v3.18.8highAV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.16.5mediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · ENISA EU

v3.16.5mediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HsecondaryAusnutzbarkeit 2.8 · Auswirkung 3.6

v3.18.8highCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:Csecondary · Siemens ProductCERT DE

v3.18.1highCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-121USCWE-121USCWE-121USCWE-121USCWE-787USCWE-787US

betroffene Produkte (84)

Betroffene Produkte und Versionsbereiche.

RUGGEDCOM RM1224alle Versionencisa_csaf_otUS
SCALANCE M-800alle Versionencisa_csaf_otUS
SCALANCE S615alle Versionencisa_csaf_otUS
SCALANCE SC-600 familyalle Versionencisa_csaf_otUS
SCALANCE XB-200alle Versionencisa_csaf_otUS
SCALANCE XC-200alle Versionencisa_csaf_otUS
SCALANCE XF-200BAalle Versionencisa_csaf_otUS
SCALANCE XM400alle Versionencisa_csaf_otUS
SCALANCE XP-200alle Versionencisa_csaf_otUS
SCALANCE XR-300WGalle Versionencisa_csaf_otUS
SCALANCE XR500alle Versionencisa_csaf_otUS
Siemens RUGGEDCOM RM1224V4.3_and_ → V6.4cisa_csaf_otUS
Siemens SCALANCE M-800V4.3_and_ → V6.4cisa_csaf_otUS
Siemens SCALANCE S615V4.3_and_ → V6.4cisa_csaf_otUS
Siemens SCALANCE SC-600 FamilyV2.0_and_ → V2.1.3cisa_csaf_otUS
Siemens SCALANCE XB-200< V4.1cisa_csaf_otUS
Siemens SCALANCE XC-200< V4.1cisa_csaf_otUS
Siemens SCALANCE XF-200BA< V4.1cisa_csaf_otUS
Siemens SCALANCE XM400< V6.2cisa_csaf_otUS
Siemens SCALANCE XP-200< V4.1cisa_csaf_otUS

20 von 84 angezeigt

Advisories (2)

Hersteller- und Ökosystem-Meldungen dazu.

SSA-979775SSA-979775: Stack Overflow Vulnerability in SCALANCE and RUGGEDCOM Devices2021-03-09csaf · siemens_psirtDE
Several firmware versions of the SCALANCE and RUGGEDCOM devices listed below are affected by a vulnerability in the passive listening feature that could allow an attacker to cause a reboot or, under specific circumstances, attain remote code execution of the affected devices. Siemens has released updates for the affected products and recommends to update to the latest versions.
ICSA-21-068-03Siemens SCALANCE and RUGGEDCOM Devices (Update A)2021-03-09icsa · cisa_csaf_otUS
Several firmware versions of the SCALANCE and RUGGEDCOM devices listed below are affected by a vulnerability in the passive listening feature that could allow an attacker to cause a reboot or, under specific circumstances, attain remote code execution of the affected devices. Siemens has released updates for the affected products and recommends to update to the latest versions.

auch bekannt als (6)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu cisa_csaf_ot siemens_psirt NVD CVE.org MITRE

veröffentlicht 2021-03-15geändert 2026-06-17

Referenzen (9)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan