Incorrect Zero Termination Vulnerability in Multiple Siemens Products (CNVD-2021-89436)

Nucleus NET modules integrate a range of standards-compliant networking and communications protocols, drivers and utilities to provide full-featured networking support in any embedded device. A security vulnerability exists in several Siemens products, which stems from the FTP server not properly validating the length of the “MKD/XMKD” command, resulting in a stack buffer overflow. An attacker could exploit the vulnerability to cause a denial of service condition and remote code execution.