Vulnerability · Published Nov 9, 2021 · Assigned by siemens
CVE-2021-31344
Medium 5.3
In plain English
A medium-severity type confusion in Capital Embedded AR Classic 431-422 from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities).
Official description
A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), PLUSCONTROL 1st Gen (All versions), SIMOTICS CONNECT 400 (All versions < V0.5.0.0), SIMOTICS CONNECT 400 (All versions < V1.0.0.0). ICMP echo packets with fake IP options allow sending ICMP echo reply messages to arbitrary hosts on the network. (FSMD-2021-0004)
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Siemens | Capital Embedded AR Classic 431-422 | 0 – before * |
| Siemens | Capital Embedded AR Classic R20-11 | 0 – before V2303 |
| Siemens | PLUSCONTROL 1st Gen | All versions |
| Siemens | SIMOTICS CONNECT 400 | All versions < V0.5.0.0 |
| Siemens | SIMOTICS CONNECT 400 | All versions < V1.0.0.0 |
Weakness: CWE-843 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-114589.pdf x_refsource_MISC
- https://cert-portal.siemens.com/productcert/pdf/ssa-044112.pdf x_refsource_MISC
- https://cert-portal.siemens.com/productcert/pdf/ssa-620288.pdf x_refsource_MISC
- https://cert-portal.siemens.com/productcert/pdf/ssa-845392.pdf x_refsource_MISC
- https://cert-portal.siemens.com/productcert/pdf/ssa-223353.pdf x_refsource_MISC
- https://cert-portal.siemens.com/productcert/html/ssa-114589.html
- https://cert-portal.siemens.com/productcert/html/ssa-044112.html
- https://cert-portal.siemens.com/productcert/html/ssa-620288.html
- https://cert-portal.siemens.com/productcert/html/ssa-845392.html
- https://cert-portal.siemens.com/productcert/html/ssa-223353.html