CVE-2021-25676
mediumpriority · track · 30EPSS 0.013 · 71 %ileDEEUUSEPSS · scored 2026-10-27
A vulnerability has been identified in RUGGEDCOM RM1224 (V6.3), SCALANCE M-800 (V6.3), SCALANCE S615 (V6.3), SCALANCE SC-600 (All Versions >= V2.1 and < V2.1.3). Multiple failed SSH authentication attempts could trigger a temporary Denial-of-Service under certain conditions. When triggered, the device will reboot automatically.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedRUGGEDCOM RM1224siemens_psirt
Update to V6.4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794349/ - FixedSCALANCE M-800siemens_psirt
Update to V6.4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794349/ - FixedSCALANCE S615siemens_psirt
Update to V6.4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794349/ - FixedSCALANCE SC-600siemens_psirt
Update to V2.1.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109793041/ - FixedRUGGEDCOM RM1224cisa_csaf_ot
Update to V6.4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794349/ - FixedSCALANCE M-800cisa_csaf_ot
Update to V6.4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794349/ - FixedSCALANCE S615cisa_csaf_ot
Update to V6.4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794349/ - FixedSCALANCE SC-600cisa_csaf_ot
Update to V2.1.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109793041/ - MitigationRUGGEDCOM RM1224siemens_psirt
Configure the built-in firewall to only allow SSH incoming connections from trusted IP addresses
- MitigationSCALANCE M-800siemens_psirt
Configure the built-in firewall to only allow SSH incoming connections from trusted IP addresses
- MitigationSCALANCE S615siemens_psirt
Configure the built-in firewall to only allow SSH incoming connections from trusted IP addresses
- MitigationSCALANCE SC-600siemens_psirt
Configure the built-in firewall to only allow SSH incoming connections from trusted IP addresses
- MitigationRUGGEDCOM RM1224cisa_csaf_ot
Configure the built-in firewall to only allow SSH incoming connections from trusted IP addresses
- MitigationSCALANCE M-800cisa_csaf_ot
Configure the built-in firewall to only allow SSH incoming connections from trusted IP addresses
- MitigationSCALANCE S615cisa_csaf_ot
Configure the built-in firewall to only allow SSH incoming connections from trusted IP addresses
- MitigationSCALANCE SC-600cisa_csaf_ot
Configure the built-in firewall to only allow SSH incoming connections from trusted IP addresses
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5–8.6
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (20)
Products and version ranges known to be affected.
- siemens ruggedcom rm1224 firmware= 6.3nvdUScpe:2.3:o:siemens:ruggedcom_rm1224_firmware:*:*:*:*:*:*:*:*
- siemens scalance sc-600 firmware2.1 → 2.1.3nvdUScpe:2.3:o:siemens:scalance_sc-600_firmware:*:*:*:*:*:*:*:*
advisories (2)
Vendor and ecosystem advisories describing this.
- SSA-296266SSA-296266: Denial-of-Service Vulnerability in SCALANCE and RUGGEDCOM Devices2021-03-09csaf · siemens_psirtDE
Some firmware versions of the SCALANCE and RUGGEDCOM devices listed below are affected by a vulnerability in the SSH authentication that could allow an attacker to cause a Denial-of-Service under certain conditions. Siemens has released updates for the affected products and recommends to update to the latest version.
- ICSA-21-068-02Siemens SCALANCE and RUGGEDCOM Devices SSH (Update A)2021-03-09icsa · cisa_csaf_otUS
Some firmware versions of the SCALANCE and RUGGEDCOM devices listed below are affected by a vulnerability in the SSH authentication that could allow an attacker to cause a Denial-of-Service under certain conditions. Siemens has released updates for the affected products and recommends to update to the latest version.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (10)
External citations — patches, advisories, analysis.
- https://cert-portal.siemens.com/productcert/pdf/ssa-296266.pdfcnnvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-979775.pdfPatchcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2021-25676cnnvd
- https://us-cert.cisa.gov/ics/advisories/icsa-21-068-02cnnvd
- https://vigilance.fr/vulnerability/Siemens-RUGGEDCOM-RM1224-denial-of-service-via-Failed-SSH-Authentication-34784cnnvd
- https://www.auscert.org.au/bulletins/ESB-2021.0846cnnvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-296266.pdfenisa_euvd
- https://us-cert.cisa.gov/ics/advisories/icsa-21-068-02enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan