CVEvulnerability

CVE-2021-31345

9.1 CRITICAL Published 2021-11-09 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-11-09
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1 ([email protected])
9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CVSS 2.0 ([email protected])
6.4 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:P
Weaknesses
CWE-1284

Description

A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), PLUSCONTROL 1st Gen (All versions). The total length of an UDP payload (set in the IP header) is unchecked. This may lead to various side effects, including Information Leak and Denial-of-Service conditions, depending on a user-defined applications that runs on top of the UDP protocol. (FSMD-2021-0006)

Affected configurations

• siemens capital vstar • siemens nucleus net • siemens nucleus readystart v3 (< 2014.12) • siemens nucleus source code • siemens apogee modular building controller firmware • siemens apogee modular equiment controller firmware • siemens apogee pxc compact firmware • siemens apogee pxc modular firmware • siemens talon tc compact firmware • siemens talon tc modular firmware

Related

Weakness · CWE (1)

  • CWE-1284 Improper Validation of Specified Quantity in Input weakness

References