Buffer overflow in Siemens Apogee Mbc (Ppc) (Bacnet)
CVE-2021-31886
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.4), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.19), APOGEE PXC Modular (BACnet) (All versions < V3.5.4), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.19), Desigo PXC00-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC00-U (All versions >= V2.3 and < V6.30.016), Desigo PXC001-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC100-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC12-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC128-U (All versions >= V2.3 and < V6.30.016), Desigo PXC200-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC22-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC22.1-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC36.1-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC50-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC64-U (All versions >= V2.3 and < V6.30.016), Desigo PXM20-E (All versions >= V2.3 and < V6.30.016), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.4), Nucleus Source Code (All versions), TALON TC Compact (BACnet) (All versions < V3.5.4), TALON TC Modular (BACnet) (All versions < V3.5.4). FTP server does not properly validate the length of the “USER” command, leading to stack-based buffer overflows. This may result in Denial-of-Service conditions and Remote Code Execution. (FSMD-2021-0010)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.030 (87.3th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 87th percentile — 87.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.030 · newest: 0.030 · change: 0.000
Affected products
- Siemens Apogee Mbc (Ppc) (Bacnet) — versions All versions
- Siemens Apogee Mbc (Ppc) (P2 Ethernet) — versions All versions
- Siemens Apogee Mec (Ppc) (Bacnet) — versions All versions
- Siemens Apogee Mec (Ppc) (P2 Ethernet) — versions All versions
- Siemens Apogee Modular Building Controller
- Siemens Apogee Modular Building Controller Firmware
- Siemens Apogee Modular Equiment Controller
- Siemens Apogee Modular Equiment Controller Firmware
- Siemens Apogee Pxc Compact
- Siemens Apogee Pxc Compact (Bacnet) — versions All versions < V3.5.4
Weakness classification (CWE)
References
- cert-portal.siemens.com/productcert/pdf/ssa-114589.pdf (Vendor Advisory)
- cert-portal.siemens.com/productcert/pdf/ssa-044112.pdf (Vendor Advisory)
Frequently asked questions
- What is CVE-2021-31886?
- CVE-2021-31886 is a critical-severity vulnerability in Siemens Apogee Mbc (Ppc) (Bacnet), classified under Improper Null Termination. CVSS score: 9.8/10. Published 2021-11-09.
- How severe is CVE-2021-31886?
- Critical severity. CVSS v3 base score is 9.8 out of 10.