PT-2021-6898 · Siemens+2 · Desigo Pxc128-U+21
Published
2021-11-09
·
Updated
2023-03-13
·
CVE-2021-31887
CVSS v2.0
10
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
APOGEE MBC (PPC) (BACnet) versions prior to V3.5.4
APOGEE MBC (PPC) (P2 Ethernet) versions prior to V2.8.19
APOGEE MEC (PPC) (BACnet) versions prior to V3.5.4
APOGEE MEC (PPC) (P2 Ethernet) versions prior to V2.8.19
APOGEE PXC Compact (BACnet) versions prior to V3.5.4
APOGEE PXC Compact (P2 Ethernet) versions prior to V2.8.19
APOGEE PXC Modular (BACnet) versions prior to V3.5.4
APOGEE PXC Modular (P2 Ethernet) versions prior to V2.8.19
Capital VSTAR (affected versions not specified)
Desigo PXC00-E.D versions prior to V6.30.016
Desigo PXC00-U versions prior to V6.30.016
Desigo PXC001-E.D versions prior to V6.30.016
Desigo PXC100-E.D versions prior to V6.30.016
Desigo PXC12-E.D versions prior to V6.30.016
Desigo PXC128-U versions prior to V6.30.016
Desigo PXC200-E.D versions prior to V6.30.016
Desigo PXC22-E.D versions prior to V6.30.016
Desigo PXC22.1-E.D versions prior to V6.30.016
Desigo PXC36.1-E.D versions prior to V6.30.016
Desigo PXC50-E.D versions prior to V6.30.016
Desigo PXC64-U versions prior to V6.30.016
Desigo PXM20-E versions prior to V6.30.016
Nucleus NET (affected versions not specified)
Nucleus ReadyStart V3 versions prior to V2017.02.4
Nucleus Source Code (affected versions not specified)
TALON TC Compact (BACnet) versions prior to V3.5.4
TALON TC Modular (BACnet) versions prior to V3.5.4
Description
The FTP server does not properly validate the length of the
PWD/XPWD command, leading to stack-based buffer overflows. This may result in Denial-of-Service conditions and Remote Code Execution.Recommendations
As a temporary workaround, consider disabling the FTP server until a patch is available.
Restrict access to the
PWD/XPWD command to minimize the risk of exploitation.
Update APOGEE MBC (PPC) (BACnet) to version V3.5.4 or later.
Update APOGEE MBC (PPC) (P2 Ethernet) to version V2.8.19 or later.
Update APOGEE MEC (PPC) (BACnet) to version V3.5.4 or later.
Update APOGEE MEC (PPC) (P2 Ethernet) to version V2.8.19 or later.
Update APOGEE PXC Compact (BACnet) to version V3.5.4 or later.
Update APOGEE PXC Compact (P2 Ethernet) to version V2.8.19 or later.
Update APOGEE PXC Modular (BACnet) to version V3.5.4 or later.
Update APOGEE PXC Modular (P2 Ethernet) to version V2.8.19 or later.
Update Desigo PXC00-E.D to version V6.30.016 or later.
Update Desigo PXC00-U to version V6.30.016 or later.
Update Desigo PXC001-E.D to version V6.30.016 or later.
Update Desigo PXC100-E.D to version V6.30.016 or later.
Update Desigo PXC12-E.D to version V6.30.016 or later.
Update Desigo PXC128-U to version V6.30.016 or later.
Update Desigo PXC200-E.D to version V6.30.016 or later.
Update Desigo PXC22-E.D to version V6.30.016 or later.
Update Desigo PXC22.1-E.D to version V6.30.016 or later.
Update Desigo PXC36.1-E.D to version V6.30.016 or later.
Update Desigo PXC50-E.D to version V6.30.016 or later.
Update Desigo PXC64-U to version V6.30.016 or later.
Update Desigo PXM20-E to version V6.30.016 or later.
Update Nucleus ReadyStart V3 to version V2017.02.4 or later.
Update TALON TC Compact (BACnet) to version V3.5.4 or later.
Update TALON TC Modular (BACnet) to version V3.5.4 or later.
At the moment, there is no information about a newer version that contains a fix for Capital VSTAR, Nucleus NET, and Nucleus Source Code.Fix
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Apogee Mec (Ppc)
Apogee Pxc Compact
Apogee Pxc Modular
Capital Vstar
Desigo Pxc00-E.D
Desigo Pxc00-U
Desigo Pxc001-E.D
Desigo Pxc100-E.D
Desigo Pxc12-E.D
Desigo Pxc128-U
Desigo Pxc200-E.D
Desigo Pxc22-E.D
Desigo Pxc22.1-E.D
Desigo Pxc36.1-E.D
Desigo Pxc50-E.D
Desigo Pxc64-U
Desigo Pxm20-E
Nucleus Net
Nucleus Readystart V3
Nucleus Source Code
Talon Tc Compact
Talon Tc Modular