CVE-2021-25667: Buffer Overflow
A vulnerability has been identified in RUGGEDCOM RM1224 (All versions >= V4.3 and < V6.4), SCALANCE M-800 (All versions >= V4.3 and < V6.4), SCALANCE S615 (All versions >= V4.3 and < V6.4), SCALANCE SC-600 Family (All versions >= V2.0 and < V2.1.3), SCALANCE XB-200 (All versions < V4.1), SCALANCE XC-200 (All versions < V4.1), SCALANCE XF-200BA (All versions < V4.1), SCALANCE XM400 (All versions < V6.2), SCALANCE XP-200 (All versions < V4.1), SCALANCE XR-300WG (All versions < V4.1), SCALANCE XR500 (All versions < V6.2). Affected devices contain a stack-based buffer overflow vulnerability in the handling of STP BPDU frames that could allow a remote attacker to trigger a denial-of-service condition or potentially remote code execution. Successful exploitation requires the passive listening feature of the device to be active.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2021-25667.
What software is affected by this vulnerability?
The RUGGEDCOM RM1224, SCALANCE M-800, SCALANCE S615, SCALANCE SC-600 Family, SCALANCE XB-200, SCALANCE XC-200, SCALANCE XF-200ba, and SCALANCE XP-200 are affected by this vulnerability.
What is the severity of CVE-2021-25667?
The severity of CVE-2021-25667 is high, with a CVSS score of 8.8.
What is the CWE ID for this vulnerability?
The CWE ID for this vulnerability is CWE-119, CWE-121, and CWE-787.
Are there any resources for more information about this vulnerability?
Yes, you can find more information about this vulnerability in the Siemens Product CERT document and the US-CERT advisory.