Vulnerability in Siemens Apogee Modular Building Controller
CVE-2021-31345
A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), PLUSCONTROL 1st Gen (All versions). The total length of an UDP payload (set in the IP header) is unchecked. This may lead to various side effects, including Information Leak and Denial-of-Service conditions, depending on a user-defined applications that runs on top of the UDP protocol. (FSMD-2021-0006)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.016 (75.9th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 76th percentile — 75.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.016 · newest: 0.016 · change: 0.000
Affected products
- Siemens Apogee Modular Building Controller
- Siemens Apogee Modular Building Controller Firmware
- Siemens Apogee Modular Equiment Controller
- Siemens Apogee Modular Equiment Controller Firmware
- Siemens Apogee Pxc Compact
- Siemens Apogee Pxc Compact Firmware
- Siemens Apogee Pxc Modular
- Siemens Apogee Pxc Modular Firmware
- Siemens Capital Embedded Ar Classic 431-422 — versions 0
- Siemens Capital Embedded Ar Classic R20-11 — versions 0
Weakness classification (CWE)
References
- cert-portal.siemens.com/productcert/pdf/ssa-114589.pdf (Vendor Advisory)
- cert-portal.siemens.com/productcert/pdf/ssa-044112.pdf (Vendor Advisory)
- cert-portal.siemens.com/productcert/pdf/ssa-620288.pdf
- cert-portal.siemens.com/productcert/pdf/ssa-845392.pdf
- cert-portal.siemens.com/productcert/html/ssa-114589.html
- cert-portal.siemens.com/productcert/html/ssa-044112.html
- cert-portal.siemens.com/productcert/html/ssa-620288.html
- cert-portal.siemens.com/productcert/html/ssa-845392.html
Frequently asked questions
- What is CVE-2021-31345?
- CVE-2021-31345 is a high-severity vulnerability in Siemens Apogee Modular Building Controller, classified under Improper Validation of Specified Quantity in Input. CVSS score: 7.5/10. Published 2021-11-09.
- How severe is CVE-2021-31345?
- High severity. CVSS v3 base score is 7.5 out of 10.