CVE-2021-29999

highpriority · track · 40EPSS 0.018 · 78 %ileEURUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
1.79% (78th) EPSS
CVSS 7.5 · high
Is it mine?
15 products
Check your exposure
Who says so?
5 sources
cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · scored 2026-10-28

An issue was discovered in Wind River VxWorks through 6.8. There is a possible stack overflow in dhcp server.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • FixedModicon M580 communication modules BMECRA BMECRA31210cisa_csaf_ot

    Modicon M580 communication modules BMECRA BMECRA31210, Modicon M580/Quantum communication modules BMXCRA BMXCRA31200/BMXCRA31210: Version SV02.80 of BMECRA31210, BMXCRA31200, BMXCRA31210 includes a fix for these vulnerabilities and is available for download.

    https://www.se.com/ww/en/product-country-selector/?pageType=product&sourceId=BMXCRA31210
  • FixedModicon M580 communication modules BMENOC BMENOC0321cisa_csaf_ot

    Modicon M580 communication modules BMENOC BMENOC0321: Version SV1.10 of BMENOC0321 includes a fix for this vulnerability and is available for download.

    https://www.se.com/ww/en/product/BMENOC0321/m580-noc-control/
  • FixedModicon M580/Quantum communication modules BMXCRA BMXCRA31200cisa_csaf_ot

    Modicon M580 communication modules BMECRA BMECRA31210, Modicon M580/Quantum communication modules BMXCRA BMXCRA31200/BMXCRA31210: Version SV02.80 of BMECRA31210, BMXCRA31200, BMXCRA31210 includes a fix for these vulnerabilities and is available for download.

    https://www.se.com/ww/en/product-country-selector/?pageType=product&sourceId=BMXCRA31210
  • Mitigation140CRA31200 (Quantum RIO Drop) 140CRA31200cisa_csaf_ot

    Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.

  • Mitigation140CRA31908 (M580 Quantum S908 RIO Drop Adapter) 140CRA31908cisa_csaf_ot

    Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.

  • MitigationModicon M580 communication modules BMECRA BMECRA31210cisa_csaf_ot

    Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.

  • MitigationModicon M580 communication modules BMENOC BMENOC0321cisa_csaf_ot

    Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.

  • MitigationModicon M580/Quantum communication modules BMXCRA BMXCRA31200cisa_csaf_ot

    Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.

  • MitigationModicon M580/Quantum communication modules BMXCRA BMXCRA31210cisa_csaf_ot

    Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.

02

cvss

Technical severity, 0–10. One row per scoring source.

9.8
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.5–9.8

v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 10 · impact 6.4
v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9
v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · CISA US
v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU
v3.19criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)
03

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-787USprimaryCWE-121USCWE-787USCWE-787US
04

affected products (15)

Products and version ranges known to be affected.

05

advisories (1)

Vendor and ecosystem advisories describing this.

  • ICSA-25-058-01Schneider Electric communication modules for Modicon M580 and Quantum controllers (Update B)2025-02-27icsa · cisa_csaf_otUS

    Successful exploitation of this vulnerability could allow a stack overflow attack, which could result in loss of confidentiality, integrity, and denial of service of the device.

06

also known as (4)

Other names and identifiers for this entity.

07

sources

Which sources assert this record, and when.

cnnvdenisa_euvdfstec_bducisa_csaf_otnvdNVDCVE.orgMITRE
published 2021-04-13modified 2026-06-17
09

references (5)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan