Vulnerability in Siemens Apogee Modular Building Controller
CVE-2021-31345
A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), PLUSCONTROL 1st Gen (All versions). The total length of an UDP payload (set in the IP header) is unchecked. This may lead to various side effects, including Information Leak and Denial-of-Service conditions, depending on a user-defined applications that runs on top of the UDP protocol. (FSMD-2021-0006)
EPSS: 0.016 (74.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Siemens Apogee_modular_building_controller
- Siemens Apogee_modular_building_controller_firmware
- Siemens Apogee_modular_equiment_controller
- Siemens Apogee_modular_equiment_controller_firmware
- Siemens Apogee_pxc_compact
- Siemens Apogee_pxc_compact_firmware
- Siemens Apogee_pxc_modular
- Siemens Apogee_pxc_modular_firmware
- Siemens Capital Embedded Ar Classic 431-422 — versions 0
- Siemens Capital Embedded Ar Classic R20-11 — versions 0
Weakness classification (CWE)
References
- productcert@siemens.com (x_refsource_MISC, Vendor Advisory)
- productcert@siemens.com (x_refsource_MISC, Vendor Advisory)
- productcert@siemens.com (x_refsource_MISC)
- productcert@siemens.com (x_refsource_MISC)
- productcert@siemens.com
- productcert@siemens.com
- productcert@siemens.com
- productcert@siemens.com
Frequently asked questions
- What is CVE-2021-31345?
- CVE-2021-31345 is a high-severity vulnerability in Siemens Apogee Modular Building Controller, classified under Improper Validation of Specified Quantity in Input. CVSS score: 7.5/10. Published 2021-11-09.
- How severe is CVE-2021-31345?
- High severity. CVSS v3 base score is 7.5 out of 10.