CVE-2021-25664 : A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All

A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.4), Nucleus ReadyStart V4 (All versions < V4.1.0), Nucleus Source Code (All versions including affected IPv6 stack). The function that processes the Hop-by-Hop extension header in IPv6 packets and its options lacks any checks against the length field of the header, allowing attackers to put the function into an infinite loop by supplying arbitrary length values.

Published 2021-04-22 21:15:10

Updated 2024-02-13 09:15:43

Source Siemens AG

View at NVD, CVE.org

Products affected by CVE-2021-25664

Siemens » Nucleus Net » Version: N/A
cpe:2.3:a:siemens:nucleus_net:-:*:*:*:*:*:*:*
Matching versions
Siemens » Nucleus Source Code » Version: N/A
cpe:2.3:a:siemens:nucleus_source_code:-:*:*:*:*:*:*:*
Matching versions
Siemens » Capital Vstar » Version: N/A
cpe:2.3:a:siemens:capital_vstar:-:*:*:*:*:*:*:*
Matching versions
Siemens » Nucleus Readystart V3
Versions before (<) 2017.02.4
cpe:2.3:a:siemens:nucleus_readystart_v3:*:*:*:*:*:*:*:*
Matching versions
Siemens » Nucleus Readystart V4
Versions before (<) 4.1.0
cpe:2.3:a:siemens:nucleus_readystart_v4:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2021-25664

EPSS FAQ

0.17%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 54 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-25664

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:N/A:P	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	Siemens AG	2024-02-13
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2021-25664

CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Assigned by: productcert@siemens.com (Primary)

References for CVE-2021-25664

https://us-cert.cisa.gov/ics/advisories/icsa-21-103-05

Siemens Nucleus Products IPv6 Stack | CISA
Third Party Advisory;US Government Resource

CVEs referencing this url
https://cert-portal.siemens.com/productcert/html/ssa-248289.html

SSA-248289

CVEs referencing this url
https://cert-portal.siemens.com/productcert/pdf/ssa-248289.pdf

Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2021-25664

Products affected by CVE-2021-25664

Exploit prediction scoring system (EPSS) score for CVE-2021-25664

CVSS scores for CVE-2021-25664

CWE ids for CVE-2021-25664

References for CVE-2021-25664