PT-2021-19563 · Unknown · Capital Embedded Ar Classic 431-422+1

Published 2021-11-09 · Updated 2024-10-08 · CVE-2021-31882

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Capital Embedded AR Classic 431-422 versions all Capital Embedded AR Classic R20-11 versions all prior to V2303

Description: A vulnerability has been identified where the DHCP client application does not validate the length of the Domain Name Server IP option(s) (0x06) when processing DHCP ACK packets. This may lead to Denial-of-Service conditions.

Recommendations: For Capital Embedded AR Classic 431-422, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Capital Embedded AR Classic R20-11 versions prior to V2303, update to version V2303 or later to resolve the issue.

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2021-31882

Affected Products

Capital Embedded Ar Classic 431-422

Capital Embedded Ar Classic R20-11

References · 8

• https://osv.dev/vulnerability/CVE-2021-31882 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-044112.pdf · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-114589.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-31882 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-620288.pdf · Note
• https://cert-portal.siemens.com/productcert/html/ssa-620288.html · Note
• https://cert-portal.siemens.com/productcert/html/ssa-114589.html · Note
• https://cert-portal.siemens.com/productcert/html/ssa-044112.html · Note