CVE-2021-31340

Siemens SIMATIC RF166C

HIGH 7.5

At a glance

Source: NVD
EPSS: EPSS 0.99 % · percentile 62 (2026-10-28)
State: PUBLISHED
Published: 2021-06-08 19:47 UTC
Updated: 2024-08-03 22:55 UTC
Assigner: siemens
NVD status: Modified

Description

A vulnerability has been identified in SIMATIC RF166C (All versions > V1.1 and < V1.3.2), SIMATIC RF185C (All versions > V1.1 and < V1.3.2), SIMATIC RF186C (All versions > V1.1 and < V1.3.2), SIMATIC RF186CI (All versions > V1.1 and < V1.3.2), SIMATIC RF188C (All versions > V1.1 and < V1.3.2), SIMATIC RF188CI (All versions > V1.1 and < V1.3.2), SIMATIC RF360R (All versions < V2.0), SIMATIC Reader RF610R CMIIT (All versions > V3.0 < V4.0), SIMATIC Reader RF610R ETSI (All versions > V3.0 < V4.0), SIMATIC Reader RF610R FCC (All versions > V3.0 < V4.0), SIMATIC Reader RF615R CMIIT (All versions > V3.0 < V4.0), SIMATIC Reader RF615R ETSI (All versions > V3.0 < V4.0), SIMATIC Reader RF615R FCC (All versions > V3.0 < V4.0), SIMATIC Reader RF650R ARIB (All versions > V3.0 < V4.0), SIMATIC Reader RF650R CMIIT (All versions > V3.0 < V4.0), SIMATIC Reader RF650R ETSI (All versions > V3.0 < V4.0), SIMATIC Reader RF650R FCC (All versions > V3.0 < V4.0), SIMATIC Reader RF680R ARIB (All versions > V3.0 < V4.0), SIMATIC Reader RF680R CMIIT (All versions > V3.0 < V4.0), SIMATIC Reader RF680R ETSI (All versions > V3.0 < V4.0), SIMATIC Reader RF680R FCC (All versions > V3.0 < V4.0), SIMATIC Reader RF685R ARIB (All versions > V3.0 < V4.0), SIMATIC Reader RF685R CMIIT (All versions > V3.0 < V4.0), SIMATIC Reader RF685R ETSI (All versions > V3.0 < V4.0), SIMATIC Reader RF685R FCC (All versions > V3.0 < V4.0). Affected devices do not properly handle large numbers of incoming connections. An attacker may leverage this to cause a Denial-of-Service situation.

Weaknesses (CWE)

CWE-400 — Uncontrolled Resource Consumption

References

https://cert-portal.siemens.com/productcert/pdf/ssa-787292.pdf

Scores

Version	Score	Vector	Scored by
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	NVD · nvd@nist.gov (Primary)
CVSS 2.0	MEDIUM 5.0	AV:N/AC:L/Au:N/C:N/I:N/A:P	NVD · nvd@nist.gov (Primary)

European references

ENISA EUVD · EUVD-2021-18250
GCVE · GCVE-0-2021-31340

CERT-FR advisories

CERTFR-2022-AVI-435 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
CERTFR-2021-AVI-442 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:o:siemens:simatic_rf166c_firmware:*:*:*:*:*:*:*:* > 1.1 < 1.3.2
cpe:2.3:o:siemens:simatic_rf185c_firmware:*:*:*:*:*:*:*:* > 1.1 < 1.3.2
cpe:2.3:o:siemens:simatic_rf186c_firmware:*:*:*:*:*:*:*:* > 1.1 < 1.3.2
cpe:2.3:o:siemens:simatic_rf186ci_firmware:*:*:*:*:*:*:*:* > 1.1 < 1.3.2
cpe:2.3:o:siemens:simatic_rf188c_firmware:*:*:*:*:*:*:*:* > 1.1 < 1.3.2
cpe:2.3:o:siemens:simatic_rf188ci_firmware:*:*:*:*:*:*:*:* > 1.1 < 1.3.2
cpe:2.3:o:siemens:simatic_rf360r_firmware:*:*:*:*:*:*:*:* < 2.0
cpe:2.3:o:siemens:simatic_reader_rf610r_cmiit_firmware:*:*:*:*:*:*:*:* ≥ 3.0 < 4.0
cpe:2.3:o:siemens:simatic_reader_rf610r_etsi_firmware:*:*:*:*:*:*:*:* ≥ 3.0 < 4.0
cpe:2.3:o:siemens:simatic_reader_rf610r_fcc_firmware:*:*:*:*:*:*:*:* ≥ 3.0 < 4.0
cpe:2.3:o:siemens:simatic_reader_rf615r_cmiit_firmware:*:*:*:*:*:*:*:* ≥ 3.0 < 4.0
cpe:2.3:o:siemens:simatic_reader_rf615r_etsi_firmware:*:*:*:*:*:*:*:* ≥ 3.0 < 4.0
cpe:2.3:o:siemens:simatic_reader_rf615r_fcc_firmware:*:*:*:*:*:*:*:* ≥ 3.0 < 4.0
cpe:2.3:o:siemens:simatic_reader_rf650r_cmiit_firmware:*:*:*:*:*:*:*:* ≥ 3.0 < 4.0
cpe:2.3:o:siemens:simatic_reader_rf650r_etsi_firmware:*:*:*:*:*:*:*:* ≥ 3.0 < 4.0
cpe:2.3:o:siemens:simatic_reader_rf650r_fcc_firmware:*:*:*:*:*:*:*:* ≥ 3.0 < 4.0
cpe:2.3:o:siemens:simatic_reader_rf650r_arib_firmware:*:*:*:*:*:*:*:* ≥ 3.0 < 4.0
cpe:2.3:o:siemens:simatic_reader_rf680r_cmiit_firmware:*:*:*:*:*:*:*:* ≥ 3.0 < 4.0
cpe:2.3:o:siemens:simatic_reader_rf680r_etsi_firmware:*:*:*:*:*:*:*:* ≥ 3.0 < 4.0
cpe:2.3:o:siemens:simatic_reader_rf680r_fcc_firmware:*:*:*:*:*:*:*:* ≥ 3.0 < 4.0
cpe:2.3:o:siemens:simatic_reader_rf680r_arib_firmware:*:*:*:*:*:*:*:* ≥ 3.0 < 4.0
cpe:2.3:o:siemens:simatic_reader_rf685r_cmiit_firmware:*:*:*:*:*:*:*:* ≥ 3.0 < 4.0
cpe:2.3:o:siemens:simatic_reader_rf685r_etsi_firmware:*:*:*:*:*:*:*:* ≥ 3.0 < 4.0
cpe:2.3:o:siemens:simatic_reader_rf685r_fcc_firmware:*:*:*:*:*:*:*:* ≥ 3.0 < 4.0
cpe:2.3:o:siemens:simatic_reader_rf685r_arib_firmware:*:*:*:*:*:*:*:* ≥ 3.0 < 4.0

Affected products

Product	Versions
Siemens · SIMATIC RF166C	affected All versions > V1.1 and < V1.3.2
Siemens · SIMATIC RF185C	affected All versions > V1.1 and < V1.3.2
Siemens · SIMATIC RF186C	affected All versions > V1.1 and < V1.3.2
Siemens · SIMATIC RF186CI	affected All versions > V1.1 and < V1.3.2
Siemens · SIMATIC RF188C	affected All versions > V1.1 and < V1.3.2
Siemens · SIMATIC RF188CI	affected All versions > V1.1 and < V1.3.2
Siemens · SIMATIC RF360R	affected All versions < V2.0
Siemens · SIMATIC Reader RF610R CMIIT	affected All versions > V3.0 < V4.0
Siemens · SIMATIC Reader RF610R ETSI	affected All versions > V3.0 < V4.0
Siemens · SIMATIC Reader RF610R FCC	affected All versions > V3.0 < V4.0
Siemens · SIMATIC Reader RF615R CMIIT	affected All versions > V3.0 < V4.0
Siemens · SIMATIC Reader RF615R ETSI	affected All versions > V3.0 < V4.0
Siemens · SIMATIC Reader RF615R FCC	affected All versions > V3.0 < V4.0
Siemens · SIMATIC Reader RF650R ARIB	affected All versions > V3.0 < V4.0
Siemens · SIMATIC Reader RF650R CMIIT	affected All versions > V3.0 < V4.0
Siemens · SIMATIC Reader RF650R ETSI	affected All versions > V3.0 < V4.0
Siemens · SIMATIC Reader RF650R FCC	affected All versions > V3.0 < V4.0
Siemens · SIMATIC Reader RF680R ARIB	affected All versions > V3.0 < V4.0
Siemens · SIMATIC Reader RF680R CMIIT	affected All versions > V3.0 < V4.0
Siemens · SIMATIC Reader RF680R ETSI	affected All versions > V3.0 < V4.0

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD