Siemens Capital Embedded AR Classic 431-422

CVE-2021-25664

HIGH 8.7

En bref

Source: NVD
EPSS: EPSS 1.88 % · centile 80 (2026-10-31)
État: PUBLISHED
Publiée: 2021-04-22 20:42 UTC
Mise à jour: 2025-03-11 09:47 UTC
Attribuée par: siemens
Statut NVD: Modified

Rechercher sur…

Description

A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.4), Nucleus ReadyStart V4 (All versions < V4.1.0), Nucleus Source Code (All versions including affected IPv6 stack). The function that processes the Hop-by-Hop extension header in IPv6 packets and its options lacks any checks against the length field of the header, allowing attackers to put the function into an infinite loop by supplying arbitrary length values.

Faiblesses (CWE)

CWE-835 — Boucle dont la condition de sortie est inatteignable (boucle infinie)

Références

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C	siemens
CVSS 4.0	HIGH 8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N	siemens
CVSS 4.0	HIGH 8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X	NVD · productcert@siemens.com (Secondary)
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	NVD · productcert@siemens.com (Secondary)
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	NVD · nvd@nist.gov (Primary)
CVSS 2.0	MEDIUM 5.0	AV:N/AC:L/Au:N/C:N/I:N/A:P	NVD · nvd@nist.gov (Primary)

Références européennes

ENISA EUVD · EUVD-2021-12556
GCVE · GCVE-0-2021-25664

Avis du CERT-FR

CERTFR-2021-AVI-854 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
CERTFR-2021-AVI-255 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

cpe:2.3:a:siemens:capital_vstar:-:*:*:*:*:*:*:*
cpe:2.3:a:siemens:nucleus_net:-:*:*:*:*:*:*:*
cpe:2.3:a:siemens:nucleus_readystart_v3:*:*:*:*:*:*:*:* < 2017.02.4
cpe:2.3:a:siemens:nucleus_readystart_v4:*:*:*:*:*:*:*:* < 4.1.0
cpe:2.3:a:siemens:nucleus_source_code:-:*:*:*:*:*:*:*

Produits affectés

Produit	Versions
Siemens · Capital Embedded AR Classic 431-422	affected 0 < *
Siemens · Capital Embedded AR Classic R20-11	affected 0 < V2303
Siemens · Nucleus NET	affected All versions
Siemens · Nucleus ReadyStart V3	affected 0 < V2017.02.4
Siemens · Nucleus ReadyStart V4	affected 0 < V4.1.0
Siemens · Nucleus Source Code	affected 0 < *

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

⚠️ Siemens Capital Embedded AR Classic 431-422