by Kastro
Paper/Archive/CVE-2021-31345

CVE-2021-31345

Siemens Capital Embedded AR Classic 431-422 — A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versio…

EPSS 2%CVSS 9.1
critical.is priorityof 100
43
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 76.2.762 × 2015.2No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), PLUSCONTROL 1st Gen (All versions). The total length of an UDP payload (set in the IP header) is unchecked. This may lead to various side effects, including Information Leak and Denial-of-Service conditions, depending on a user-defined applications that runs on top of the UDP protocol. (FSMD-2021-0006)

Affected

ProductAffectedFixed inSource
Capital Embedded AR Classic 431-422all versions–CNA
Capital Embedded AR Classic R20-11< V2303V2303CNA
PLUSCONTROL 1st GenAll versions–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
siemens (CNA)7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

refcert-portal.siemens.com/productcert/pdf/ssa-114589.pdfrefcert-portal.siemens.com/productcert/pdf/ssa-044112.pdfrefcert-portal.siemens.com/productcert/pdf/ssa-620288.pdfrefcert-portal.siemens.com/productcert/pdf/ssa-845392.pdfrefcert-portal.siemens.com/productcert/html/ssa-114589.htmlrefcert-portal.siemens.com/productcert/html/ssa-044112.htmlrefcert-portal.siemens.com/productcert/html/ssa-620288.htmlrefcert-portal.siemens.com/productcert/html/ssa-845392.html