CVE-2021-31227
mediumpriority · track · 31stack campaign · INFRA:HALTEPSS 0.017 · 77 %ileDEEURUUSEPSS · scored 2026-10-27
An issue was discovered in HCC embedded InterNiche 4.0.1. A potential heap buffer overflow exists in the code that parses the HTTP POST request, due to an incorrect signed integer comparison. This vulnerability requires the attacker to send a malformed HTTP packet with a negative Content-Length, which bypasses the size checks and results in a large heap overflow in the wbs_multidata buffer copy.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- Fixedphoenix_contact_psirt
Phoenix Contact Classic Line Controllers are designed and developed for the use in closed industrial networks. The control and configuration protocols do not feature authentication mechanisms by design. Phoenix Contact therefore strongly recommends using the devices exclusively in closed networks and protected by a suitable firewall. Phoenix Contact is offering the mGuard product family for network segmentation and protection.
- FixedInterNiche stackcisa_csaf_ot
Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-022_en.pdf - FixedNicheLitecisa_csaf_ot
Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-022_en.pdf - Mitigationphoenix_contact_psirt
Customers using Phoenix Contact Classic Line Controllers are strongly recommended to operate the devices in closed networks or protected with a suitable firewall as intended. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our application note: Measures to protect network-capable devices with Ethernet connection
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5–7.5
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (12)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- VDE-2021-032PHOENIX CONTACT: Niche Ethernet Stack for ILC1x0, ILC1x1 and AXC 1050 Industrial controllers and CHARX control DC2021-08-04csaf · phoenix_contact_psirtDE
Third party Niche Ethernet stack has several vulnerabilities announced by the security researcher's community. Phoenix Contact Classic Line industrial controllers are developed and designed for the use in closed industrial networks. The communication protocols and device access do not feature authentication measures. Remote attackers can use specially crafted IP packets to cause a Denial of Service or a Breach of Integrity of the PLC.
- ICSA-21-217-01HCC Embedded InterNiche TCP/IP stack, NicheLite (Update B)2021-08-05icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities may result in unauthorized access to arbitrary information, DNS cache poisoning, remote code execution, or a denial-of-service condition.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (10)
External citations — patches, advisories, analysis.
- https://nvd.nist.gov/vuln/detail/CVE-2021-31227cnnvd
- https://us-cert.cisa.gov/ics/advisories/icsa-21-217-01cnnvd
- https://www.auscert.org.au/bulletins/ESB-2021.2661cnnvd
- https://www.cybersecurity-help.cz/vdb/SB2021080607cnnvd
- https://www.forescout.com/blog/new-critical-operational-technology-vulnerabilities-found-on-nichestack/cnnvd
- https://www.kb.cert.org/vuls/id/608209cnnvd
- https://www.forescout.com/blog/new-critical-operational-technology-vulnerabilities-found-on-nichestack/enisa_euvd
- https://www.kb.cert.org/vuls/id/608209enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan