CVE-2021-31401
mediumpriority · track · 31stack campaign · INFRA:HALTEPSS 0.023 · 83 %ileDEEURUUSEPSS · scored 2026-10-27
An issue was discovered in tcp_rcv() in nptcp.c in HCC embedded InterNiche 4.0.1. The TCP header processing code doesn't sanitize the value of the IP total length field (header length + data length). With a crafted IP packet, an integer overflow occurs whenever the value of the IP data length is calculated by subtracting the length of the header from the total length of the IP packet.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedSENTRON 3WA COM190siemens_psirt
Update to V2.0.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109782123/ - FixedSENTRON 3WL COM35siemens_psirt
Update to V1.2.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109766651/ - FixedSENTRON 7KM PAC Switched Ethernet PROFINET Expansion Modulesiemens_psirt
Update to V2.1.6 or later version
https://support.industry.siemens.com/cs/ww/en/view/109749555/ - Fixedpilz_psirt
| Produkt | Maßnahme | |----------------------------------------------|------------------------------------------------------| | PSSu-Module für dezentrales E/A-System | siehe Mitigation | | PSSu-Module für PSS 4000 | Firmware auf 1.22.2 aktualisieren * | | PNOZ m B1 | siehe Mitigation ** | | PNOZ m ES ETH | siehe Mitigation ** | | PNOZ mmc1p ETH | siehe Mitigation | | Base-Device PNOZ mxp ETH (PNOZmulti Classic) | siehe Mitigation | \* CVE-2020-35685 wird in diesem Update nicht behoben, da es keine Auswirkungen auf die Sicherheit der verwendeten Dienste und Protokolle (MODBUS/TCP und RAW-TCP) hat. \** Diese Produkte sind im Feld nicht updatefähig. Sie verwenden eine vom Hersteller vorinstallierte, feste Firmware.
- Fixedphoenix_contact_psirt
Phoenix Contact Classic Line Controllers are designed and developed for the use in closed industrial networks. The control and configuration protocols do not feature authentication mechanisms by design. Phoenix Contact therefore strongly recommends using the devices exclusively in closed networks and protected by a suitable firewall. Phoenix Contact is offering the mGuard product family for network segmentation and protection.
- FixedInterNiche stackcisa_csaf_ot
Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-022_en.pdf - FixedNicheLitecisa_csaf_ot
Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-022_en.pdf - Mitigationpilz_psirt
It is adviced to use firewalls or similar network security devices to prevent unauthorized network communication to the products affected.
- Mitigationphoenix_contact_psirt
Customers using Phoenix Contact Classic Line Controllers are strongly recommended to operate the devices in closed networks or protected with a suitable firewall as intended. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our application note: Measures to protect network-capable devices with Ethernet connection
- Mitigationweidmueller_psirt
Fieldbuses (including Industrial Ethernet protocols) in general are not intended for direct connection with the internet, as they lack a proper set of security capabilities. This also applies to Weidmüller IP20 Remote I/O fieldbus couplers, which are developed and designed for operation in closed industrial networks. - Do not directly connect the affected products to the internet. - Restrict network access to the affected products by proper secured network infrastructure (e.g. routers, firewalls, DMZ, VPNs). - Restrict physical access to the industrial network and affected products (e.g cabinets, seals, closures).
- No fix plannedSENTRON 7KM PAC Switched Ethernet PROFINET Expansion Modulesiemens_psirt
Currently no remediation is planned
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5–7.5
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (43)
Products and version ranges known to be affected.
- siemens sentron 3wa com190 firmware< 2.0.0nvdUScpe:2.3:o:siemens:sentron_3wa_com190_firmware:*:*:*:*:*:*:*:*
- siemens sentron 3wl com35 firmware< 1.2.0nvdUScpe:2.3:o:siemens:sentron_3wl_com35_firmware:*:*:*:*:*:*:*:*
advisories (5)
Vendor and ecosystem advisories describing this.
- SSA-789208SSA-789208: Multiple Vulnerabilities (INFRA:HALT) in Interniche IP-Stack based Low Voltage Devices2021-08-04csaf · siemens_psirtDE
Security researchers discovered and disclosed 14 vulnerabilities in the Interniche IP stack, also known as "INFRA:HALT" vulnerabilities [0]. This advisory describes the impact to Siemens low voltage products, which are only affected by four out of the 14 vulnerabilities. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available. [0] https://www.forescout.com/blog/new-critical-operational-technology-vulnerabilities-found-on-nichestack/
- VDE-2021-009Pilz: Multiple products prone to Niche Ethernet Stack vulnerabilities2021-09-20csaf · pilz_psirtDE
Multiple products of PILZ utilise a third-party TCP/IP implementation - the "Niche Ethernet Stack". This TCP/IP stack contains multiple vulnerabilities which are therefore affecting the products listed above.
- VDE-2021-032PHOENIX CONTACT: Niche Ethernet Stack for ILC1x0, ILC1x1 and AXC 1050 Industrial controllers and CHARX control DC2021-08-04csaf · phoenix_contact_psirtDE
Third party Niche Ethernet stack has several vulnerabilities announced by the security researcher's community. Phoenix Contact Classic Line industrial controllers are developed and designed for the use in closed industrial networks. The communication protocols and device access do not feature authentication measures. Remote attackers can use specially crafted IP packets to cause a Denial of Service or a Breach of Integrity of the PLC.
- VDE-2021-042Weidmueller: Remote I/O fieldbus couplers (IP20) affected by INFRA:HALT vulnerabilities2021-10-18csaf · weidmueller_psirtDE
The Weidmueller Remote I/O (IP20) fieldbus couplers (u-remote) are affected by several vulnerabilities of the third-party TCP/IP Niche stack. An attacker may use crafted IP packets to cause a denial of service or breach of integrity of the affected products. Weidmueller recommends restricting network access from the internet and also locally to reduce the attack vector to a manageable minimum.
- ICSA-21-217-01HCC Embedded InterNiche TCP/IP stack, NicheLite (Update B)2021-08-05icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities may result in unauthorized access to arbitrary information, DNS cache poisoning, remote code execution, or a denial-of-service condition.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (12)
External citations — patches, advisories, analysis.
- https://cert-portal.siemens.com/productcert/pdf/ssa-789208.pdfcnnvd
- https://us-cert.cisa.gov/ics/advisories/icsa-21-217-01cnnvd
- https://www.auscert.org.au/bulletins/ESB-2021.2661cnnvd
- https://www.cybersecurity-help.cz/vdb/SB2021080607cnnvd
- https://www.forescout.com/blog/new-critical-operational-technology-vulnerabilities-found-on-nichestack/cnnvd
- https://www.kb.cert.org/vuls/id/608209cnnvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-789208.pdfenisa_euvd
- https://www.forescout.com/blog/new-critical-operational-technology-vulnerabilities-found-on-nichestack/enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan