CVE-2021-31346

CVE-2021-31346 affects Siemens Nucleus NET/KERNEL-based devices (Capital Embedded AR Classic, PLUSCONTROL, SIMOTICS CONNECT 400, Capital VSTAR, etc.). Root cause: the total length of an ICMP payload (set in the IP header) is unchecked, enabling information leaks and Denial-of-Service conditions v...

CVE-2021-31889

CVE-2021-31889 is an integer underflow in the Nucleus NET TCP/IP stack used by several Siemens products (APOGEE MBC/MEC, PLUSCONTROL, Capital VSTAR, SIMOTICS CONNECT 400, etc.). The flaw arises from malformed TCP packets with a corrupted SACK option, enabling information leaks and denial-of-servi...

CVE-2021-31890

CVE-2021-31890 stems from an unchecked TCP payload length in Siemens Nucleus NET stack used across multiple Siemens products (e.g., Capital Embedded AR Classic, PLUSCONTROL, SIMOTICS CONNECT 400, etc.). The issue enables information leaks and Denial-of-Service conditions depending on network buff...

CVE-2021-31345

CVE-2021-31345 affects Siemens Nucleus NET-based products (Capital Embedded AR Classic, CAPITAL VSTAR/PLUSCONTROL) with an unchecked UDP payload length in the IP header. Root cause: UDP payload length is not validated, enabling information leaks and potential denial-of-service depending on the us...

CVE-2022-38371

CVE-2022-38371 is a memory/resource handling flaw in Siemens Nucleus FTP server that can cause remote denial of service by failing to release memory for incomplete FTP connections. Affected products span APOGEE MBC/MEC PXC, Desigo PXC variants, TALON TC, Nucleus NET/ReadyStart, and Nucleus Source...

CVE-2021-31887

CVE-2021-31887 affects a wide range of Siemens APOGEE/TALON/Nucleus products (BACnet and P2 Ethernet variants, various Desigo/PXC/Nucleus lines). The root cause is a stack-based buffer overwrite in the FTP server caused by improper validation of the length of the PWD/XPWD command, which may allow...

CVE-2021-31886

Technical details for CVE-2021-31886 (affected software, impact, exploitability, and remediation) are not present in the provided Connected documents. Please monitor for updates.

CVE-2020-15795

CVE-2020-15795 affects Siemens APOGEE PXC/Nucleus/TALON products (BACnet and P2 Ethernet) and related DNS modules. The vulnerability is in DNS domain name label parsing, where malformed DNS responses could cause a write past the end of an allocated structure, enabling code execution or denial of ...

CVE-2020-27738

CVE-2020-27738 concerns the DNS domain name record decompression in Siemens APOGEE PXC/TALON, Nucleus, SIMOTICS CONNECT 400 and related DNS modules. The issue is improper validation of pointer offsets during DNS response parsing, which can cause a read past the end of an allocated structure and l...

CVE-2019-13939

CVE-2019-13939 affects Siemens Mentor Nucleus Networking Module family (including APOGEE MEC/MBC/PXC, Desigo PXC, PXM, Nucleus NET/RTOS/ReadyStart, SIMOTICS/TALON, VSTAR) across numerous versions. The root cause is improper handling of DHCP packets: when the DHCP client is enabled, an attacker se...

CVE-2021-31883

CVE-2021-31883 affects Siemens APOGEE MBC / TALON products (Nucleus RTOS) including APOGEE MBC (PPC/BACnet), APOGEE MEC, APOGEE PXC Compact/Modular, Desigo PXC variants, and Capital VSTAR with Ethernet options. Root cause: DHCP client processing fails to validate the length of Vendor option(s) in...

CVE-2020-27737

Siemens APOGEE PXC, Nucleus and TALON/SIMOTICS products are affected by a DNS response parsing vulnerability that can read past allocated memory when processing malformed DNS responses. A privileged attacker on the network could cause a denial of service or memory leakage. Remediation is to updat...

CVE-2021-31344

CVE-2021-31344 affects Siemens/Nucleus-based devices such as Capital Embedded AR Classic, PLUSCONTROL 1st Gen, and SIMOTICS CONNECT 400 (all versions with certain UDP/ICMP handling). The vulnerability is triggered by ICMP echo packets with fake IP options, enabling ICMP echo replies to arbitrary ...

CVE-2020-27736

Summary (supported): CVE-2020-27736 affects Siemens APOGEE PXC (BACnet and P2 Ethernet), Nucleus NET/ReadyStart/Source Code, SIMOTICS CONNECT 400, TALON TC (and related Nucleus/DNS modules). The vulnerability stems from improper validation in the DNS domain name label parsing of DNS responses, wh...

CVE-2020-27009

The CVE-2020-27009 issue affects Siemens APOGEE PXC and TALON TC series, plus Nucleus NET/Source Code with DNS DNS domain name record decompression. Root cause: DNS domain name record decompression does not properly validate pointer offsets, allowing parsing of malformed DNS responses to write be...

CVE-2021-25663

The CVE-2021-25663 vulnerability affects Siemens Nucleus family: Capital Embedded AR Classic (431-422, all versions; R20-11 < V2303), Nucleus NET, Nucleus ReadyStart V3 (< V2017.02.4), V4 (

CVE-2021-31888

Summary of CVE-2021-31888 : The vulnerability affects APOGEE/MBC/MEC/PXC family devices (BACnet/P2 Ethernet) and related Desigo/Nucleus/TALON/Nucleus RTOS components listed in the description. The issue is a stack-based buffer overflow in the FTP server caused by improper validation of the length...

CVE-2021-31881

CVE-2021-31881 involves APOGEE MBC/TALON/Desigo PXC software family (Siemens Nucleus RTOS, BACnet/PPC) where the DHCP client fails to validate the Vendor option length when processing DHCP OFFER, leading to Denial-of-Service. Multiple Tenable OT/Nessus entries corroborate this family of DHCP leng...

CVE-2021-31884

CVE-2021-31884 affects Siemens Nucleus/APOGEE/TALON family (MBC/MEC/PXC/Nucleus) with a DHCP client hostname option handling flaw. The DHCP hostname data is not guaranteed to be NULL-terminated, which can cause out-of-bounds reads/writes and Denial-of-Service. The available connected sources conf...

CVE-2021-25677

CVE-2021-25677 concerns DNS transaction ID randomness in Siemens DNS clients across multiple products (APOGEE PXC BACnet/P2 Ethernet, Nucleus NET/ReadyStart, SIMOTICS CONNECT 400, TALON TC). Root cause: DNS client does not properly randomize transaction IDs, enabling potential DNS cache poisoning...

CVE-2021-31882

CVE-2021-31882 affects Siemens APOGEE MBC/TALON/Nucleus products (e.g., Capital Embedded AR Classic 431-422 family and AR Classic R20-11, affected “All versions” in some entries). The root cause is that the DHCP client does not validate the length of the Domain Name Server IP option (0x06) when p...

CVE-2021-31885

CVE-2021-31885 : TFTP memory buffer reading vulnerability reported in Siemens Nucleus APOGEE/MBC/TALON/TALON-related products (PPC/BACnet, P2 Ethernet, Desigo PXC, PXM, Nucleus NET, etc.) where a malformed TFTP command can read the contents of the TFTP memory buffer. Source documents from the vul...

CVE-2020-28388

The CVE-2020-28388 issue affects Siemens APOGEE PXC and TALON TC series, Nucleus NET/ReadyStart/Source Code, PLUSCONTROL, and related products. Root cause: Initial Sequence Numbers (ISNs) for TCP connections are derived from an insufficiently random source, making current and future ISNs predicta...

CVE-2021-27393

The CVE-2021-27393 vulnerability affects Siemens Nucleus DNS modules (Nucleus NET all versions; Nucleus ReadyStart all versions prior to v2013.08; Nucleus Source Code with affected DNS modules; Nucleus RTOS/Nucleus ReadyStart/VSTAR context as noted) where the DNS client does not randomize UDP por...

CVE-2021-25664

The CVE-2021-25664 entry affects Capital Embedded AR Classic 431-422 (all versions), Capital Embedded AR Classic R20-11 (all versions < V2303), Nucleus NET (all versions), Nucleus ReadyStart V3 (< V2017.02.4), V4 (