CVE-2021-31344

mediumpriority · track · 22stack campaign · NUCLEUS:13EPSS 0.015 · 73 %ileDEEUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
1.46% (73rd) EPSS
CVSS 5 · medium
Is it mine?
103 products
Check your exposure
Who says so?
6 sources
cnnvd · enisa_euvd · cisa_csaf_ot · siemens_psirt

EPSS · scored 2026-10-26

A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), PLUSCONTROL 1st Gen (All versions), SIMOTICS CONNECT 400 (All versions < V0.5.0.0), SIMOTICS CONNECT 400 (All versions < V1.0.0.0). ICMP echo packets with fake IP options allow sending ICMP echo reply messages to arbitrary hosts on the network. (FSMD-2021-0004)

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • FixedNucleus ReadyStart V3siemens_psirt

    Update to V2017.02.4 or later version

    https://support.sw.siemens.com/en-US/product/1009925838/
  • FixedNucleus ReadyStart V4siemens_psirt

    Update to V4.1.1 or later version

    https://support.sw.siemens.com/en-US/product/1336134128/
  • FixedNucleus Source Codesiemens_psirt

    Contact customer support to receive patch and update information

  • FixedAPOGEE PXC Compact (BACnet)siemens_psirt

    Update to V3.5.4 or later version

  • FixedAPOGEE PXC Compact (P2 Ethernet)siemens_psirt

    Update to V2.8.19 or later version

  • FixedAPOGEE PXC Modular (BACnet)siemens_psirt

    Update to V3.5.4 or later version

  • FixedAPOGEE PXC Modular (P2 Ethernet)siemens_psirt

    Update to V2.8.19 or later version

  • FixedDesigo PXC00-E.Dsiemens_psirt

    Update to V6.30.016 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109810577
  • FixedDesigo PXC00-Usiemens_psirt

    Update to V6.30.016 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109810577
  • FixedDesigo PXC001-E.Dsiemens_psirt

    Update to V6.30.016 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109810577
  • FixedDesigo PXC100-E.Dsiemens_psirt

    Update to V6.30.016 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109810577
  • FixedDesigo PXC12-E.Dsiemens_psirt

    Update to V6.30.016 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109810577
  • FixedDesigo PXC128-Usiemens_psirt

    Update to V6.30.016 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109810577
  • FixedDesigo PXC200-E.Dsiemens_psirt

    Update to V6.30.016 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109810577
  • FixedDesigo PXC22-E.Dsiemens_psirt

    Update to V6.30.016 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109810577
  • FixedDesigo PXC22.1-E.Dsiemens_psirt

    Update to V6.30.016 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109810577
  • FixedDesigo PXC36.1-E.Dsiemens_psirt

    Update to V6.30.016 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109810577
  • FixedDesigo PXC50-E.Dsiemens_psirt

    Update to V6.30.016 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109810577
  • FixedDesigo PXC64-Usiemens_psirt

    Update to V6.30.016 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109810577
  • FixedDesigo PXM20-Esiemens_psirt

    Update to V6.30.016 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109810577
  • FixedTALON TC Compact (BACnet)siemens_psirt

    Update to V3.5.4 or later version

  • FixedTALON TC Modular (BACnet)siemens_psirt

    Update to V3.5.4 or later version

  • FixedSIMOTICS CONNECT 400siemens_psirt

    Update to V0.5.0.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109778383/
  • FixedCapital Embedded AR Classic R20-11siemens_psirt

    Update to V2303 or later version

  • Fixedwago_psirt

    For fieldbus coupler: - 750-332 - 750-362/xxx-xxx - 750-363/xxx-xxx - 750-364/xxx-xxx - 750-365/xxx-xxx For PLCs: - 750-823 - 750-832/xxx-xxx - 750-862 - 750-890/xxx-xxx - 750-891 - 750-893 We recommend all effected users to update to the firmware version listed below: | Article Number | Fixed in Firmware Version | Availability | |----------------------|----------------------------|---------------------------| | 750-823 | >=FW10 | January 2022 | | 750-832/000-00x | >=FW10 | After BACnet certification| | 750-862 | >=FW10 | January 2022 | | 750-890/xxx-xxx | >=FW10 | January 2022 | | 750-891 | >=FW10 | January 2022 | | 750-893 | >=FW10 | January 2022 | | 750-332 | >=FW10 | After BACnet certification| | 750-362/xxx-xxx | >=FW10 | January 2022 | | 750-363/xxx-xxx | >=FW10 | January 2022 | | 750-364/xxx-xxx | >=FW10 | January 2022 | | 750-365/xxx-xxx | >=FW10 | January 2022 |

  • FixedNucleus ReadyStart V3cisa_csaf_ot

    Update to V2017.02.4 or later version

    https://support.sw.siemens.com/en-US/product/1009925838/
  • FixedNucleus ReadyStart V4cisa_csaf_ot

    Update to V4.1.1 or later version

    https://support.sw.siemens.com/en-US/product/1336134128/
  • FixedNucleus Source Codecisa_csaf_ot

    Contact customer support to receive patch and update information

  • FixedAPOGEE PXC Compact (BACnet)cisa_csaf_ot

    Update to V3.5.4 or later version

  • FixedAPOGEE PXC Compact (P2 Ethernet)cisa_csaf_ot

    Update to V2.8.19 or later version

  • FixedAPOGEE PXC Modular (BACnet)cisa_csaf_ot

    Update to V3.5.4 or later version

  • FixedAPOGEE PXC Modular (P2 Ethernet)cisa_csaf_ot

    Update to V2.8.19 or later version

  • FixedDesigo PXC00-E.Dcisa_csaf_ot

    Update to V6.30.016 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109810577
  • FixedDesigo PXC00-Ucisa_csaf_ot

    Update to V6.30.016 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109810577
  • FixedDesigo PXC001-E.Dcisa_csaf_ot

    Update to V6.30.016 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109810577
  • FixedDesigo PXC100-E.Dcisa_csaf_ot

    Update to V6.30.016 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109810577
  • FixedDesigo PXC12-E.Dcisa_csaf_ot

    Update to V6.30.016 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109810577
  • FixedDesigo PXC128-Ucisa_csaf_ot

    Update to V6.30.016 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109810577
  • FixedDesigo PXC200-E.Dcisa_csaf_ot

    Update to V6.30.016 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109810577
  • FixedDesigo PXC22-E.Dcisa_csaf_ot

    Update to V6.30.016 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109810577
  • FixedDesigo PXC22.1-E.Dcisa_csaf_ot

    Update to V6.30.016 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109810577
  • FixedDesigo PXC36.1-E.Dcisa_csaf_ot

    Update to V6.30.016 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109810577
  • FixedDesigo PXC50-E.Dcisa_csaf_ot

    Update to V6.30.016 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109810577
  • FixedDesigo PXC64-Ucisa_csaf_ot

    Update to V6.30.016 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109810577
  • FixedDesigo PXM20-Ecisa_csaf_ot

    Update to V6.30.016 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109810577
  • FixedTALON TC Compact (BACnet)cisa_csaf_ot

    Update to V3.5.4 or later version

  • FixedTALON TC Modular (BACnet)cisa_csaf_ot

    Update to V3.5.4 or later version

  • FixedCapital Embedded AR Classic R20-11cisa_csaf_ot

    Update to V2303 or later version

  • FixedSIMOTICS CONNECT 400cisa_csaf_ot

    Update to V0.5.0.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109778383/
  • MitigationNucleus NETsiemens_psirt

    Contact customer support or your local Nucleus Sales team for mitigation advice

  • MitigationAPOGEE MBC (PPC) (BACnet)siemens_psirt

    CVE-2021-31881, CVE-2021-31882, CVE-2021-31883, CVE-2021-31884: Disable the DHCP client and use static IP address configuration instead (Note that the DHCP client is disabled by default on APOGEE/TALON and Desigo products.)

  • MitigationAPOGEE MBC (PPC) (P2 Ethernet)siemens_psirt

    CVE-2021-31881, CVE-2021-31882, CVE-2021-31883, CVE-2021-31884: Disable the DHCP client and use static IP address configuration instead (Note that the DHCP client is disabled by default on APOGEE/TALON and Desigo products.)

  • MitigationAPOGEE MEC (PPC) (BACnet)siemens_psirt

    CVE-2021-31881, CVE-2021-31882, CVE-2021-31883, CVE-2021-31884: Disable the DHCP client and use static IP address configuration instead (Note that the DHCP client is disabled by default on APOGEE/TALON and Desigo products.)

  • MitigationAPOGEE MEC (PPC) (P2 Ethernet)siemens_psirt

    CVE-2021-31881, CVE-2021-31882, CVE-2021-31883, CVE-2021-31884: Disable the DHCP client and use static IP address configuration instead (Note that the DHCP client is disabled by default on APOGEE/TALON and Desigo products.)

  • MitigationAPOGEE PXC Compact (BACnet)siemens_psirt

    CVE-2021-31881, CVE-2021-31882, CVE-2021-31883, CVE-2021-31884: Disable the DHCP client and use static IP address configuration instead (Note that the DHCP client is disabled by default on APOGEE/TALON and Desigo products.)

  • MitigationAPOGEE PXC Compact (P2 Ethernet)siemens_psirt

    CVE-2021-31881, CVE-2021-31882, CVE-2021-31883, CVE-2021-31884: Disable the DHCP client and use static IP address configuration instead (Note that the DHCP client is disabled by default on APOGEE/TALON and Desigo products.)

  • MitigationAPOGEE PXC Modular (BACnet)siemens_psirt

    CVE-2021-31881, CVE-2021-31882, CVE-2021-31883, CVE-2021-31884: Disable the DHCP client and use static IP address configuration instead (Note that the DHCP client is disabled by default on APOGEE/TALON and Desigo products.)

  • MitigationAPOGEE PXC Modular (P2 Ethernet)siemens_psirt

    CVE-2021-31881, CVE-2021-31882, CVE-2021-31883, CVE-2021-31884: Disable the DHCP client and use static IP address configuration instead (Note that the DHCP client is disabled by default on APOGEE/TALON and Desigo products.)

  • MitigationDesigo PXC00-E.Dsiemens_psirt

    CVE-2021-31881, CVE-2021-31882, CVE-2021-31883, CVE-2021-31884: Disable the DHCP client and use static IP address configuration instead (Note that the DHCP client is disabled by default on APOGEE/TALON and Desigo products.)

  • MitigationDesigo PXC00-Usiemens_psirt

    CVE-2021-31881, CVE-2021-31882, CVE-2021-31883, CVE-2021-31884: Disable the DHCP client and use static IP address configuration instead (Note that the DHCP client is disabled by default on APOGEE/TALON and Desigo products.)

  • MitigationDesigo PXC001-E.Dsiemens_psirt

    CVE-2021-31881, CVE-2021-31882, CVE-2021-31883, CVE-2021-31884: Disable the DHCP client and use static IP address configuration instead (Note that the DHCP client is disabled by default on APOGEE/TALON and Desigo products.)

  • MitigationDesigo PXC100-E.Dsiemens_psirt

    CVE-2021-31881, CVE-2021-31882, CVE-2021-31883, CVE-2021-31884: Disable the DHCP client and use static IP address configuration instead (Note that the DHCP client is disabled by default on APOGEE/TALON and Desigo products.)

  • MitigationDesigo PXC12-E.Dsiemens_psirt

    CVE-2021-31881, CVE-2021-31882, CVE-2021-31883, CVE-2021-31884: Disable the DHCP client and use static IP address configuration instead (Note that the DHCP client is disabled by default on APOGEE/TALON and Desigo products.)

  • MitigationDesigo PXC128-Usiemens_psirt

    CVE-2021-31881, CVE-2021-31882, CVE-2021-31883, CVE-2021-31884: Disable the DHCP client and use static IP address configuration instead (Note that the DHCP client is disabled by default on APOGEE/TALON and Desigo products.)

  • MitigationDesigo PXC200-E.Dsiemens_psirt

    CVE-2021-31881, CVE-2021-31882, CVE-2021-31883, CVE-2021-31884: Disable the DHCP client and use static IP address configuration instead (Note that the DHCP client is disabled by default on APOGEE/TALON and Desigo products.)

  • MitigationDesigo PXC22-E.Dsiemens_psirt

    CVE-2021-31881, CVE-2021-31882, CVE-2021-31883, CVE-2021-31884: Disable the DHCP client and use static IP address configuration instead (Note that the DHCP client is disabled by default on APOGEE/TALON and Desigo products.)

  • MitigationDesigo PXC22.1-E.Dsiemens_psirt

    CVE-2021-31881, CVE-2021-31882, CVE-2021-31883, CVE-2021-31884: Disable the DHCP client and use static IP address configuration instead (Note that the DHCP client is disabled by default on APOGEE/TALON and Desigo products.)

  • MitigationDesigo PXC36.1-E.Dsiemens_psirt

    CVE-2021-31881, CVE-2021-31882, CVE-2021-31883, CVE-2021-31884: Disable the DHCP client and use static IP address configuration instead (Note that the DHCP client is disabled by default on APOGEE/TALON and Desigo products.)

  • MitigationDesigo PXC50-E.Dsiemens_psirt

    CVE-2021-31881, CVE-2021-31882, CVE-2021-31883, CVE-2021-31884: Disable the DHCP client and use static IP address configuration instead (Note that the DHCP client is disabled by default on APOGEE/TALON and Desigo products.)

  • MitigationDesigo PXC64-Usiemens_psirt

    CVE-2021-31881, CVE-2021-31882, CVE-2021-31883, CVE-2021-31884: Disable the DHCP client and use static IP address configuration instead (Note that the DHCP client is disabled by default on APOGEE/TALON and Desigo products.)

  • MitigationDesigo PXM20-Esiemens_psirt

    CVE-2021-31881, CVE-2021-31882, CVE-2021-31883, CVE-2021-31884: Disable the DHCP client and use static IP address configuration instead (Note that the DHCP client is disabled by default on APOGEE/TALON and Desigo products.)

  • MitigationTALON TC Compact (BACnet)siemens_psirt

    CVE-2021-31881, CVE-2021-31882, CVE-2021-31883, CVE-2021-31884: Disable the DHCP client and use static IP address configuration instead (Note that the DHCP client is disabled by default on APOGEE/TALON and Desigo products.)

  • MitigationTALON TC Modular (BACnet)siemens_psirt

    CVE-2021-31881, CVE-2021-31882, CVE-2021-31883, CVE-2021-31884: Disable the DHCP client and use static IP address configuration instead (Note that the DHCP client is disabled by default on APOGEE/TALON and Desigo products.)

  • MitigationCapital Embedded AR Classic 431-422siemens_psirt

    Apply network segmentation and put the ECUs behind properly configured gateways/firewalls

  • MitigationCapital Embedded AR Classic R20-11siemens_psirt

    Apply network segmentation and put the ECUs behind properly configured gateways/firewalls

  • MitigationPLUSCONTROL 1st Gensiemens_psirt

    PLUSCONTROL devices are typically located in a separate LAN segment of energy transmission solutions, where an attacker could use these vulnerabilities to disrupt SER messages or Trace functionalities. Therefore, review the status of the defense in depth recommendations that apply to your specific deployment and align as needed. Especially the measures on the network layer to prevent accessibility from other network segments.

  • Mitigationwago_psirt

    1. Use general security best practices to protect systems from local and network attacks. 2. Do not allow direct access to the device from untrusted networks. 3. Update to the latest firmware according to the table in chapter solutions. 4. Disable the DHCP, DNS and the FTP port 21. 5. Industrial control systems (ICS) should not be directly accessible from the Internet, but should be protected by consistently applying the defense-in-depth strategy. The BSI provides general information on securing ICS in the ICS Compendium [BSI2013] and on the official BSI website [BSI2021]. For fieldbus coupler: - 750-331 - 750-352/xxx-xxx For PLCs: - 750-829 - 750-831/xxx-xxx - 750-852 - 750-880/xxx-xxx - 750-881 - 750-889 The listed fieldbus coupler and PLCs above are based on Nucleus V1 RTOS. At the moment there are no updates for this version available. Due to this reason WAGO recommends according to the recommendations of the BSI to implement the following measures: 1. Enforce segmentation controls and proper network hygiene to reduce the risk of vulnerable devices. Restrict external communication paths and isolate vulnerable devices in zones as a mitigating measure. 2. Ensure DHCP responses from non-authorized servers are blocked or discarded. 3. Monitor network traffic for anomalies and discard invalid packets. 4. Disable or block FTP, DHCP, DNS especially on critical network segments 5. Please check regularly https://certvde.com/de/ for an update of this Advisory.

  • Mitigationphoenix_contact_psirt

    Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our application note: Measures to protect network-capable devices with Ethernet connection

  • MitigationNucleus NETcisa_csaf_ot

    Contact customer support or your local Nucleus Sales team for mitigation advice

  • MitigationAPOGEE MBC (PPC) (BACnet)cisa_csaf_ot

    CVE-2021-31881, CVE-2021-31882, CVE-2021-31883, CVE-2021-31884: Disable the DHCP client and use static IP address configuration instead (Note that the DHCP client is disabled by default on APOGEE/TALON and Desigo products.)

  • MitigationAPOGEE MBC (PPC) (P2 Ethernet)cisa_csaf_ot

    CVE-2021-31881, CVE-2021-31882, CVE-2021-31883, CVE-2021-31884: Disable the DHCP client and use static IP address configuration instead (Note that the DHCP client is disabled by default on APOGEE/TALON and Desigo products.)

  • MitigationAPOGEE MEC (PPC) (BACnet)cisa_csaf_ot

    CVE-2021-31881, CVE-2021-31882, CVE-2021-31883, CVE-2021-31884: Disable the DHCP client and use static IP address configuration instead (Note that the DHCP client is disabled by default on APOGEE/TALON and Desigo products.)

  • MitigationAPOGEE MEC (PPC) (P2 Ethernet)cisa_csaf_ot

    CVE-2021-31881, CVE-2021-31882, CVE-2021-31883, CVE-2021-31884: Disable the DHCP client and use static IP address configuration instead (Note that the DHCP client is disabled by default on APOGEE/TALON and Desigo products.)

  • MitigationAPOGEE PXC Compact (BACnet)cisa_csaf_ot

    CVE-2021-31881, CVE-2021-31882, CVE-2021-31883, CVE-2021-31884: Disable the DHCP client and use static IP address configuration instead (Note that the DHCP client is disabled by default on APOGEE/TALON and Desigo products.)

  • MitigationAPOGEE PXC Compact (P2 Ethernet)cisa_csaf_ot

    CVE-2021-31881, CVE-2021-31882, CVE-2021-31883, CVE-2021-31884: Disable the DHCP client and use static IP address configuration instead (Note that the DHCP client is disabled by default on APOGEE/TALON and Desigo products.)

  • MitigationAPOGEE PXC Modular (BACnet)cisa_csaf_ot

    CVE-2021-31881, CVE-2021-31882, CVE-2021-31883, CVE-2021-31884: Disable the DHCP client and use static IP address configuration instead (Note that the DHCP client is disabled by default on APOGEE/TALON and Desigo products.)

  • MitigationAPOGEE PXC Modular (P2 Ethernet)cisa_csaf_ot

    CVE-2021-31881, CVE-2021-31882, CVE-2021-31883, CVE-2021-31884: Disable the DHCP client and use static IP address configuration instead (Note that the DHCP client is disabled by default on APOGEE/TALON and Desigo products.)

  • MitigationDesigo PXC00-E.Dcisa_csaf_ot

    CVE-2021-31881, CVE-2021-31882, CVE-2021-31883, CVE-2021-31884: Disable the DHCP client and use static IP address configuration instead (Note that the DHCP client is disabled by default on APOGEE/TALON and Desigo products.)

  • MitigationDesigo PXC00-Ucisa_csaf_ot

    CVE-2021-31881, CVE-2021-31882, CVE-2021-31883, CVE-2021-31884: Disable the DHCP client and use static IP address configuration instead (Note that the DHCP client is disabled by default on APOGEE/TALON and Desigo products.)

  • MitigationDesigo PXC001-E.Dcisa_csaf_ot

    CVE-2021-31881, CVE-2021-31882, CVE-2021-31883, CVE-2021-31884: Disable the DHCP client and use static IP address configuration instead (Note that the DHCP client is disabled by default on APOGEE/TALON and Desigo products.)

  • MitigationDesigo PXC100-E.Dcisa_csaf_ot

    CVE-2021-31881, CVE-2021-31882, CVE-2021-31883, CVE-2021-31884: Disable the DHCP client and use static IP address configuration instead (Note that the DHCP client is disabled by default on APOGEE/TALON and Desigo products.)

  • MitigationDesigo PXC12-E.Dcisa_csaf_ot

    CVE-2021-31881, CVE-2021-31882, CVE-2021-31883, CVE-2021-31884: Disable the DHCP client and use static IP address configuration instead (Note that the DHCP client is disabled by default on APOGEE/TALON and Desigo products.)

  • MitigationDesigo PXC128-Ucisa_csaf_ot

    CVE-2021-31881, CVE-2021-31882, CVE-2021-31883, CVE-2021-31884: Disable the DHCP client and use static IP address configuration instead (Note that the DHCP client is disabled by default on APOGEE/TALON and Desigo products.)

  • MitigationDesigo PXC200-E.Dcisa_csaf_ot

    CVE-2021-31881, CVE-2021-31882, CVE-2021-31883, CVE-2021-31884: Disable the DHCP client and use static IP address configuration instead (Note that the DHCP client is disabled by default on APOGEE/TALON and Desigo products.)

  • MitigationDesigo PXC22-E.Dcisa_csaf_ot

    CVE-2021-31881, CVE-2021-31882, CVE-2021-31883, CVE-2021-31884: Disable the DHCP client and use static IP address configuration instead (Note that the DHCP client is disabled by default on APOGEE/TALON and Desigo products.)

  • MitigationDesigo PXC22.1-E.Dcisa_csaf_ot

    CVE-2021-31881, CVE-2021-31882, CVE-2021-31883, CVE-2021-31884: Disable the DHCP client and use static IP address configuration instead (Note that the DHCP client is disabled by default on APOGEE/TALON and Desigo products.)

  • MitigationDesigo PXC36.1-E.Dcisa_csaf_ot

    CVE-2021-31881, CVE-2021-31882, CVE-2021-31883, CVE-2021-31884: Disable the DHCP client and use static IP address configuration instead (Note that the DHCP client is disabled by default on APOGEE/TALON and Desigo products.)

  • MitigationDesigo PXC50-E.Dcisa_csaf_ot

    CVE-2021-31881, CVE-2021-31882, CVE-2021-31883, CVE-2021-31884: Disable the DHCP client and use static IP address configuration instead (Note that the DHCP client is disabled by default on APOGEE/TALON and Desigo products.)

  • MitigationDesigo PXC64-Ucisa_csaf_ot

    CVE-2021-31881, CVE-2021-31882, CVE-2021-31883, CVE-2021-31884: Disable the DHCP client and use static IP address configuration instead (Note that the DHCP client is disabled by default on APOGEE/TALON and Desigo products.)

  • MitigationDesigo PXM20-Ecisa_csaf_ot

    CVE-2021-31881, CVE-2021-31882, CVE-2021-31883, CVE-2021-31884: Disable the DHCP client and use static IP address configuration instead (Note that the DHCP client is disabled by default on APOGEE/TALON and Desigo products.)

  • MitigationTALON TC Compact (BACnet)cisa_csaf_ot

    CVE-2021-31881, CVE-2021-31882, CVE-2021-31883, CVE-2021-31884: Disable the DHCP client and use static IP address configuration instead (Note that the DHCP client is disabled by default on APOGEE/TALON and Desigo products.)

  • MitigationTALON TC Modular (BACnet)cisa_csaf_ot

    CVE-2021-31881, CVE-2021-31882, CVE-2021-31883, CVE-2021-31884: Disable the DHCP client and use static IP address configuration instead (Note that the DHCP client is disabled by default on APOGEE/TALON and Desigo products.)

  • MitigationCapital Embedded AR Classic 431-422cisa_csaf_ot

    Apply network segmentation and put the ECUs behind properly configured gateways/firewalls

  • MitigationCapital Embedded AR Classic R20-11cisa_csaf_ot

    Apply network segmentation and put the ECUs behind properly configured gateways/firewalls

  • MitigationPLUSCONTROL 1st Gencisa_csaf_ot

    PLUSCONTROL devices are typically located in a separate LAN segment of energy transmission solutions, where an attacker could use these vulnerabilities to disrupt SER messages or Trace functionalities. Therefore, review the status of the defense in depth recommendations that apply to your specific deployment and align as needed. Especially the measures on the network layer to prevent accessibility from other network segments.

  • No fix plannedNucleus NETsiemens_psirt

    Currently no remediation is planned

  • No fix plannedAPOGEE MBC (PPC) (BACnet)siemens_psirt

    Currently no fix is planned

  • No fix plannedAPOGEE MBC (PPC) (P2 Ethernet)siemens_psirt

    Currently no fix is planned

  • No fix plannedAPOGEE MEC (PPC) (BACnet)siemens_psirt

    Currently no fix is planned

  • No fix plannedAPOGEE MEC (PPC) (P2 Ethernet)siemens_psirt

    Currently no fix is planned

  • No fix plannedCapital Embedded AR Classic 431-422siemens_psirt

    Currently no fix is planned

  • No fix plannedPLUSCONTROL 1st Gensiemens_psirt

    Currently no remediation is planned

  • No fix plannedNucleus NETcisa_csaf_ot

    Currently no remediation is planned

  • No fix plannedAPOGEE MBC (PPC) (BACnet)cisa_csaf_ot

    Currently no fix is planned

  • No fix plannedAPOGEE MBC (PPC) (P2 Ethernet)cisa_csaf_ot

    Currently no fix is planned

  • No fix plannedAPOGEE MEC (PPC) (BACnet)cisa_csaf_ot

    Currently no fix is planned

  • No fix plannedAPOGEE MEC (PPC) (P2 Ethernet)cisa_csaf_ot

    Currently no fix is planned

  • No fix plannedCapital Embedded AR Classic 431-422cisa_csaf_ot

    Currently no fix is planned

  • No fix plannedPLUSCONTROL 1st Gencisa_csaf_ot

    Currently no remediation is planned

02

cvss

Technical severity, 0–10. One row per scoring source.

6.9
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 2.7–6.9

v2.05mediumAV:N/AC:L/Au:N/C:N/I:P/A:Nprimary · NVD / NIST USexploitability 10 · impact 2.9
v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Nprimary · NVD / NIST USexploitability 3.9 · impact 1.4
v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Nsecondary · productcert@siemens.com DEexploitability 3.9 · impact 1.4
v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Nsecondary · CISA US
v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Nsecondary · Siemens ProductCERT DE
v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Nsecondary · Phoenix Contact PSIRT DE
v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Nsecondary · WAGO PSIRT DE
v4.06.9mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · productcert@siemens.com DE
v4.06.9mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:Nsecondary · ENISA EU
v4.02.7lowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)
03

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-843USCWE-843USCWE-843USCWE-843USCWE-843US
04

affected products (103)

Products and version ranges known to be affected.

showing 20 of 103
05

advisories (12)

Vendor and ecosystem advisories describing this.

  • SSA-044112SSA-044112: Multiple Vulnerabilities (NUCLEUS:13) in the TCP/IP Stack of Nucleus RTOS2021-11-09csaf · siemens_psirtDE

    The TCP/IP stack and related services (FTP, TFTP) of the networking component (Nucleus NET) in Nucleus Real-Time Operating System (RTOS) contain several vulnerabilities, also known as "NUCLEUS:13" and as documented below. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends countermeasures for products where updates are not available.

  • SSA-114589SSA-114589: Multiple Vulnerabilities in Nucleus RTOS based APOGEE, TALON and Desigo PXC/PXM Products2021-11-09csaf · siemens_psirtDE

    Multiple vulnerabilities (also known as "NUCLEUS:13") have been identified in the Nucleus RTOS (real-time operating system) and reported in the Siemens Security Advisory SSA-044112: https://cert-portal.siemens.com/productcert/pdf/ssa-044112.pdf. The products listed below use affected versions of the Nucleus software and inherently contain these vulnerabilities. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available.

  • SSA-223353SSA-223353: Multiple Vulnerabilities in Nucleus RTOS based SIMOTICS CONNECT 4002022-03-08csaf · siemens_psirtDE

    Multiple vulnerabilities (also known as “NUCLEUS:13”) have been identified in the Nucleus RTOS (real-time operating system), originally reported in the Siemens Security Advisory SSA-044112: https://cert-portal.siemens.com/productcert/pdf/ssa-044112.pdf. SIMOTICS CONNECT 400 devices are affected by some of the vulnerabilities as documented below. Siemens has released an update for the SIMOTICS CONNECT 400 and recommends to update to the latest version.

  • SSA-620288SSA-620288: Multiple Vulnerabilities (NUCLEUS:13) in Capital Embedded AR Classic2021-12-14csaf · siemens_psirtDE

    Multiple vulnerabilities (also known as "NUCLEUS:13") have be identified in the Nucleus RTOS (real-time operating system) and reported in the Siemens Security Advisory SSA-044112: https://cert-portal.siemens.com/productcert/html/ssa-044112.html. Capital Embedded AR Classic uses an affected version of the Nucleus software and inherently contains several of these vulnerabilities. Siemens has released a new version for Capital Embedded AR Classic R20-11 and recommends to update to the latest version. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.

  • SSA-845392SSA-845392: Multiple Vulnerabilities in Nucleus RTOS based Siemens Energy PLUSCONTROL 1st Gen Devices2022-01-11csaf · siemens_psirtDE

    Multiple vulnerabilities (also known as "NUCLEUS:13") have been identified in the Nucleus RTOS (real-time operating system) and reported in the Siemens Security Advisory SSA-044112: https://cert-portal.siemens.com/productcert/pdf/ssa-044112.pdf. PLUSCONTROL 1st Gen devices are affected by some of the vulnerabilities as documented below. Siemens Energy recommends specific countermeasures for products where updates are not available.

  • VDE-2021-050WAGO: Multiple devices affected by Vulnerabilities in NUCLEUS TCP Stack.2021-11-16csaf · wago_psirtDE

    Multiple vulnerabilities were reported in the Nucleus Real-Time Operating System (RTOS). The Nucleus RTOS is an essential component in several WAGO PLCs and fieldbus coupler. WAGO uses older Versions of the Nucleus RTOS also in legacy products. For additional information please consult the official Siemens advisory: • Advisory SSA-044112

  • VDE-2021-059PHOENIX CONTACT: BLUEMARK X1 / LED / CLED printers utilizing the Siemens Nucleus RTOS TCP/IP Stack2022-01-11csaf · phoenix_contact_psirtDE

    The TCP/IP stack and of the networking component (Nucleus NET) in Nucleus Real-Time Operating System (RTOS) contain several vulnerabilities. Nucleus NET is utilized by BLUEMARK X1 / LED / CLED. The abovementioned BLUEMARK printers are discontinued and only impacted by a subset of 8 of the 13 discovered vulnerabilities.

  • ICSA-21-313-03Siemens Nucleus RTOS TCP/IP Stack2021-11-09icsa · cisa_csaf_otUS

    The TCP/IP stack and related services (FTP, TFTP) of the networking component (Nucleus NET) in Nucleus Real-Time Operating System (RTOS) contain several vulnerabilities, also known as "NUCLEUS:13" and as documented below. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends countermeasures for products where updates are not available.

  • ICSA-21-315-07Siemens Nucleus RTOS-based APOGEE and TALON Products (Update C)2021-11-09icsa · cisa_csaf_otUS

    Multiple vulnerabilities (also known as "NUCLEUS:13") have been identified in the Nucleus RTOS (real-time operating system) and reported in the Siemens Security Advisory SSA-044112: https://cert-portal.siemens.com/productcert/pdf/ssa-044112.pdf. The products listed below use affected versions of the Nucleus software and inherently contain these vulnerabilities. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available.

  • ICSA-21-350-06Siemens Capital VSTAR2021-12-14icsa · cisa_csaf_otUS

    Multiple vulnerabilities (also known as "NUCLEUS:13") have be identified in the Nucleus RTOS (real-time operating system) and reported in the Siemens Security Advisory SSA-044112: https://cert-portal.siemens.com/productcert/html/ssa-044112.html. Capital Embedded AR Classic uses an affected version of the Nucleus software and inherently contains several of these vulnerabilities. Siemens has released a new version for Capital Embedded AR Classic R20-11 and recommends to update to the latest version. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.

  • ICSA-22-013-03Siemens Energy PLUSCONTROL2022-01-11icsa · cisa_csaf_otUS

    Multiple vulnerabilities (also known as "NUCLEUS:13") have been identified in the Nucleus RTOS (real-time operating system) and reported in the Siemens Security Advisory SSA-044112: https://cert-portal.siemens.com/productcert/pdf/ssa-044112.pdf. PLUSCONTROL 1st Gen devices are affected by some of the vulnerabilities as documented below. Siemens Energy recommends specific countermeasures for products where updates are not available.

  • ICSA-22-069-02Siemens SIMOTICS CONNECT 4002022-03-08icsa · cisa_csaf_otUS

    Multiple vulnerabilities (also known as “NUCLEUS:13”) have been identified in the Nucleus RTOS (real-time operating system), originally reported in the Siemens Security Advisory SSA-044112: https://cert-portal.siemens.com/productcert/pdf/ssa-044112.pdf. SIMOTICS CONNECT 400 devices are affected by some of the vulnerabilities as documented below. Siemens has released an update for the SIMOTICS CONNECT 400 and recommends to update to the latest version.

06

also known as (3)

Other names and identifiers for this entity.

07

sources

Which sources assert this record, and when.

cnnvdenisa_euvdcisa_csaf_otsiemens_psirtwago_psirtphoenix_contact_psirtNVDCVE.orgMITRE
published 2021-11-09modified 2026-06-17
08

references (43)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan