Log in Start free

Vulnerability · Published Jun 8, 2021 · Assigned by siemens

CVE-2021-31340

High 7.5

In plain English

A high-severity uncontrolled resource consumption in SIMATIC Reader RF610R CMIIT from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities).

Severity (CVSS NVD)7.5High
Exploit odds (30 days)1.0%top 37.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A vulnerability has been identified in SIMATIC RF166C (All versions > V1.1 and < V1.3.2), SIMATIC RF185C (All versions > V1.1 and < V1.3.2), SIMATIC RF186C (All versions > V1.1 and < V1.3.2), SIMATIC RF186CI (All versions > V1.1 and < V1.3.2), SIMATIC RF188C (All versions > V1.1 and < V1.3.2), SIMATIC RF188CI (All versions > V1.1 and < V1.3.2), SIMATIC RF360R (All versions < V2.0), SIMATIC Reader RF610R CMIIT (All versions > V3.0 < V4.0), SIMATIC Reader RF610R ETSI (All versions > V3.0 < V4.0), SIMATIC Reader RF610R FCC (All versions > V3.0 < V4.0), SIMATIC Reader RF615R CMIIT (All versions > V3.0 < V4.0), SIMATIC Reader RF615R ETSI (All versions > V3.0 < V4.0), SIMATIC Reader RF615R FCC (All versions > V3.0 < V4.0), SIMATIC Reader RF650R ARIB (All versions > V3.0 < V4.0), SIMATIC Reader RF650R CMIIT (All versions > V3.0 < V4.0), SIMATIC Reader RF650R ETSI (All versions > V3.0 < V4.0), SIMATIC Reader RF650R FCC (All versions > V3.0 < V4.0), SIMATIC Reader RF680R ARIB (All versions > V3.0 < V4.0), SIMATIC Reader RF680R CMIIT (All versions > V3.0 < V4.0), SIMATIC Reader RF680R ETSI (All versions > V3.0 < V4.0), SIMATIC Reader RF680R FCC (All versions > V3.0 < V4.0), SIMATIC Reader RF685R ARIB (All versions > V3.0 < V4.0), SIMATIC Reader RF685R CMIIT (All versions > V3.0 < V4.0), SIMATIC Reader RF685R ETSI (All versions > V3.0 < V4.0), SIMATIC Reader RF685R FCC (All versions > V3.0 < V4.0). Affected devices do not properly handle large numbers of incoming connections. An attacker may leverage this to cause a Denial-of-Service situation.

Affected products (as reported)

VendorProductVersions
Siemens SIMATIC RF166C All versions > V1.1 and < V1.3.2
Siemens SIMATIC RF185C All versions > V1.1 and < V1.3.2
Siemens SIMATIC RF186C All versions > V1.1 and < V1.3.2
Siemens SIMATIC RF186CI All versions > V1.1 and < V1.3.2
Siemens SIMATIC RF188C All versions > V1.1 and < V1.3.2
Siemens SIMATIC RF188CI All versions > V1.1 and < V1.3.2
Siemens SIMATIC RF360R All versions < V2.0
Siemens SIMATIC Reader RF610R CMIIT All versions > V3.0 < V4.0
Siemens SIMATIC Reader RF610R ETSI All versions > V3.0 < V4.0
Siemens SIMATIC Reader RF610R FCC All versions > V3.0 < V4.0
Siemens SIMATIC Reader RF615R CMIIT All versions > V3.0 < V4.0
Siemens SIMATIC Reader RF615R ETSI All versions > V3.0 < V4.0
Siemens SIMATIC Reader RF615R FCC All versions > V3.0 < V4.0
Siemens SIMATIC Reader RF650R ARIB All versions > V3.0 < V4.0
Siemens SIMATIC Reader RF650R CMIIT All versions > V3.0 < V4.0
Siemens SIMATIC Reader RF650R ETSI All versions > V3.0 < V4.0
Siemens SIMATIC Reader RF650R FCC All versions > V3.0 < V4.0
Siemens SIMATIC Reader RF680R ARIB All versions > V3.0 < V4.0
Siemens SIMATIC Reader RF680R CMIIT All versions > V3.0 < V4.0
Siemens SIMATIC Reader RF680R ETSI All versions > V3.0 < V4.0
Siemens SIMATIC Reader RF680R FCC All versions > V3.0 < V4.0
Siemens SIMATIC Reader RF685R ARIB All versions > V3.0 < V4.0
Siemens SIMATIC Reader RF685R CMIIT All versions > V3.0 < V4.0
Siemens SIMATIC Reader RF685R ETSI All versions > V3.0 < V4.0
Siemens SIMATIC Reader RF685R FCC All versions > V3.0 < V4.0

Weakness: CWE-400

References