PT-2021-4817 · Siemens+2 · Desigo Pxc128-U+21

Published 2021-11-09 · Updated 2023-06-26 · CVE-2021-31884

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions APOGEE MBC (PPC) (BACnet) versions prior to V3.5.4 APOGEE MBC (PPC) (P2 Ethernet) versions prior to V2.8.19 APOGEE MEC (PPC) (BACnet) versions prior to V3.5.4 APOGEE MEC (PPC) (P2 Ethernet) versions prior to V2.8.19 APOGEE PXC Compact (BACnet) versions prior to V3.5.4 APOGEE PXC Compact (P2 Ethernet) versions prior to V2.8.19 APOGEE PXC Modular (BACnet) versions prior to V3.5.4 APOGEE PXC Modular (P2 Ethernet) versions prior to V2.8.19 Capital VSTAR versions with enabled Ethernet options Desigo PXC00-E.D versions prior to V6.30.016 Desigo PXC00-U versions prior to V6.30.016 Desigo PXC001-E.D versions prior to V6.30.016 Desigo PXC100-E.D versions prior to V6.30.016 Desigo PXC12-E.D versions prior to V6.30.016 Desigo PXC128-U versions prior to V6.30.016 Desigo PXC200-E.D versions prior to V6.30.016 Desigo PXC22-E.D versions prior to V6.30.016 Desigo PXC22.1-E.D versions prior to V6.30.016 Desigo PXC36.1-E.D versions prior to V6.30.016 Desigo PXC50-E.D versions prior to V6.30.016 Desigo PXC64-U versions prior to V6.30.016 Desigo PXM20-E versions prior to V6.30.016 Nucleus NET versions prior to V2017.02.4 Nucleus ReadyStart V3 versions prior to V2017.02.4 Nucleus Source Code versions prior to V2017.02.4 TALON TC Compact (BACnet) versions prior to V3.5.4 TALON TC Modular (BACnet) versions prior to V3.5.4

Description The issue is related to a buffer overflow in the DHCP client application, which assumes that the data supplied with the Hostname DHCP option is NULL terminated. If the global hostname variable is not defined, this may lead to out-of-bound reads, writes, and denial-of-service conditions.

Recommendations APOGEE MBC (PPC) (BACnet) versions prior to V3.5.4: Update to version V3.5.4 or later. APOGEE MBC (PPC) (P2 Ethernet) versions prior to V2.8.19: Update to version V2.8.19 or later. APOGEE MEC (PPC) (BACnet) versions prior to V3.5.4: Update to version V3.5.4 or later. APOGEE MEC (PPC) (P2 Ethernet) versions prior to V2.8.19: Update to version V2.8.19 or later. APOGEE PXC Compact (BACnet) versions prior to V3.5.4: Update to version V3.5.4 or later. APOGEE PXC Compact (P2 Ethernet) versions prior to V2.8.19: Update to version V2.8.19 or later. APOGEE PXC Modular (BACnet) versions prior to V3.5.4: Update to version V3.5.4 or later. APOGEE PXC Modular (P2 Ethernet) versions prior to V2.8.19: Update to version V2.8.19 or later. Capital VSTAR versions with enabled Ethernet options: Disable Ethernet options until a patch is available. Desigo PXC00-E.D versions prior to V6.30.016: Update to version V6.30.016 or later. Desigo PXC00-U versions prior to V6.30.016: Update to version V6.30.016 or later. Desigo PXC001-E.D versions prior to V6.30.016: Update to version V6.30.016 or later. Desigo PXC100-E.D versions prior to V6.30.016: Update to version V6.30.016 or later. Desigo PXC12-E.D versions prior to V6.30.016: Update to version V6.30.016 or later. Desigo PXC128-U versions prior to V6.30.016: Update to version V6.30.016 or later. Desigo PXC200-E.D versions prior to V6.30.016: Update to version V6.30.016 or later. Desigo PXC22-E.D versions prior to V6.30.016: Update to version V6.30.016 or later. Desigo PXC22.1-E.D versions prior to V6.30.016: Update to version V6.30.016 or later. Desigo PXC36.1-E.D versions prior to V6.30.016: Update to version V6.30.016 or later. Desigo PXC50-E.D versions prior to V6.30.016: Update to version V6.30.016 or later. Desigo PXC64-U versions prior to V6.30.016: Update to version V6.30.016 or later. Desigo PXM20-E versions prior to V6.30.016: Update to version V6.30.016 or later. Nucleus NET versions prior to V2017.02.4: Update to version V2017.02.4 or later. Nucleus ReadyStart V3 versions prior to V2017.02.4: Update to version V2017.02.4 or later. Nucleus Source Code versions prior to V2017.02.4: Update to version V2017.02.4 or later. TALON TC Compact (BACnet) versions prior to V3.5.4: Update to version V3.5.4 or later. TALON TC Modular (BACnet) versions prior to V3.5.4: Update to version V3.5.4 or later.

Fix

Out of bounds Read

Memory Corruption

Weakness Enumeration

CWE-170

CWE-125

CWE-787

Related Identifiers

BDU:2021-05545

CVE-2021-31884

Affected Products

Apogee Mec (Ppc)

Apogee Pxc Compact

Apogee Pxc Modular

Capital Vstar

Desigo Pxc00-E.D

Desigo Pxc00-U

Desigo Pxc001-E.D

Desigo Pxc100-E.D

Desigo Pxc12-E.D

Desigo Pxc128-U

Desigo Pxc200-E.D

Desigo Pxc22-E.D

Desigo Pxc22.1-E.D

Desigo Pxc36.1-E.D

Desigo Pxc50-E.D

Desigo Pxc64-U

Desigo Pxm20-E

Nucleus Net

Nucleus Readystart V3

Nucleus Source Code

Talon Tc Compact

Talon Tc Modular

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2021-31884 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-620288.pdf · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-044112.pdf · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-114589.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-31884 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05545 · Security Note
• https://t.me/cibsecurity/32031 · Telegram Post