CVE-2021-25664

mediumpriority · track · 31EPSS 0.019 · 79 %ileDEEUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
1.88% (79th) EPSS
CVSS 5 · medium
Is it mine?
33 products
Check your exposure
Who says so?
5 sources
cnnvd · enisa_euvd · cert_bund · cisa_csaf_ot

EPSS · scored 2026-10-27

A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.4), Nucleus ReadyStart V4 (All versions < V4.1.0), Nucleus Source Code (All versions including affected IPv6 stack). The function that processes the Hop-by-Hop extension header in IPv6 packets and its options lacks any checks against the length field of the header, allowing attackers to put the function into an infinite loop by supplying arbitrary length values.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • FixedCapital Embedded AR Classic R20-11siemens_psirt

    Update to V2303 or later version

  • FixedNucleus ReadyStart V3siemens_psirt

    Update to V2017.02.4 or later version

  • FixedNucleus ReadyStart V4siemens_psirt

    Update to V4.1.0 or later version

  • FixedNucleus Source Codesiemens_psirt

    Contact customer support to receive patch and update information

  • FixedCapital Embedded AR Classic R20-11cisa_csaf_ot

    Update to V2303 or later version

  • FixedNucleus ReadyStart V3cisa_csaf_ot

    Update to V2017.02.4 or later version

  • FixedNucleus ReadyStart V4cisa_csaf_ot

    Update to V4.1.0 or later version

  • FixedNucleus Source Codecisa_csaf_ot

    Contact customer support to receive patch and update information

  • MitigationCapital Embedded AR Classic 431-422siemens_psirt

    Disable IPv6 functionality, if feature not used, by deselecting the TcpIpIpV6General/IpV6Enabled Pre-Compile configuration option

  • MitigationCapital Embedded AR Classic R20-11siemens_psirt

    Disable IPv6 functionality, if feature not used, by deselecting the TcpIpIpV6General/IpV6Enabled Pre-Compile configuration option

  • MitigationNucleus NETsiemens_psirt

    Contact customer support or your local Nucleus Sales team for mitigation advice

  • MitigationCapital Embedded AR Classic 431-422cisa_csaf_ot

    Disable IPv6 functionality, if feature not used, by deselecting the TcpIpIpV6General/IpV6Enabled Pre-Compile configuration option

  • MitigationCapital Embedded AR Classic R20-11cisa_csaf_ot

    Disable IPv6 functionality, if feature not used, by deselecting the TcpIpIpV6General/IpV6Enabled Pre-Compile configuration option

  • MitigationNucleus NETcisa_csaf_ot

    Contact customer support or your local Nucleus Sales team for mitigation advice

  • No fix plannedCapital Embedded AR Classic 431-422siemens_psirt

    Currently no fix is planned

  • No fix plannedNucleus NETsiemens_psirt

    Currently no fix is planned

  • No fix plannedCapital Embedded AR Classic 431-422cisa_csaf_ot

    Currently no fix is planned

  • No fix plannedNucleus NETcisa_csaf_ot

    Currently no fix is planned

02

cvss

Technical severity, 0–10. One row per scoring source.

8.7
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5–8.7

v2.05mediumAV:N/AC:L/Au:N/C:N/I:N/A:Pprimary · NVD / NIST USexploitability 10 · impact 2.9
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 3.6
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · productcert@siemens.com DEexploitability 3.9 · impact 3.6
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:Csecondary · Siemens ProductCERT DE
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:Csecondary · CISA US
v4.06.6mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)
v4.08.7highCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:Nsecondary · ENISA EU
v4.08.7highCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · productcert@siemens.com DE
03

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-835USCWE-835USCWE-835US
04

affected products (33)

Products and version ranges known to be affected.

showing 20 of 33
05

advisories (3)

Vendor and ecosystem advisories describing this.

  • SSA-248289SSA-248289: Denial of Service Vulnerabilities in the IPv6 Stack of Nucleus RTOS2021-04-13csaf · siemens_psirtDE

    The IPv6 stack of the networking component (Nucleus NET) in Nucleus Real-Time Operating System (RTOS) contains two vulnerabilities when processing IPv6 headers which could allow an attacker to cause a denial of service condition. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends countermeasures for products where fixes are not, or not yet available.

  • WID-SEC-W-2023-1986NAME:WRECK: Mehrere Schwachstellen in TCP/IP StacksDeutsch2021-04-15csaf · cert_bundDE

    Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Siemens Nucleus Net, Siemens Nucleus RTOS, Microsoft Azure RTOS NetX und Wind River VxWorks ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen oder einen Denial of Service zu verursachen.

  • ICSA-21-103-05Siemens Nucleus Products IPv6 Stack2021-04-13icsa · cisa_csaf_otUS

    The IPv6 stack of the networking component (Nucleus NET) in Nucleus Real-Time Operating System (RTOS) contains two vulnerabilities when processing IPv6 headers which could allow an attacker to cause a denial of service condition. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends countermeasures for products where fixes are not, or not yet available.

06

also known as (3)

Other names and identifiers for this entity.

07

sources

Which sources assert this record, and when.

cnnvdenisa_euvdcert_bundcisa_csaf_otsiemens_psirtNVDCVE.orgMITRE
published 2021-04-22modified 2026-06-17
08

references (12)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan