CVE-2021-31890: Input Validation

Published Nov 9, 2021
·
Updated

A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.4), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.19), APOGEE PXC Modular (BACnet) (All versions < V3.5.4), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.19), Capital VSTAR (All versions with enabled Ethernet options), Desigo PXC00-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC00-U (All versions >= V2.3 and < V6.30.016), Desigo PXC001-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC100-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC12-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC128-U (All versions >= V2.3 and < V6.30.016), Desigo PXC200-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC22-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC22.1-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC36.1-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC50-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC64-U (All versions >= V2.3 and < V6.30.016), Desigo PXM20-E (All versions >= V2.3 and < V6.30.016), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.4), Nucleus ReadyStart V4 (All versions < V4.1.1), Nucleus Source Code (All versions), PLUSCONTROL 1st Gen (All versions), SIMOTICS CONNECT 400 (All versions < V0.5.0.0), TALON TC Compact (BACnet) (All versions < V3.5.4), TALON TC Modular (BACnet) (All versions < V3.5.4). The total length of an TCP payload (set in the IP header) is unchecked. This may lead to various side effects, including Information Leak and Denial-of-Service conditions, depending on the network buffer organization in memory. (FSMD-2021-0017)

Other sources

A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), PLUSCONTROL 1st Gen (All versions), SIMOTICS CONNECT 400 (All versions < V0.5.0.0), SIMOTICS CONNECT 400 (All versions < V1.0.0.0). The total length of an TCP payload (set in the IP header) is unchecked. This may lead to various side effects, including Information Leak and Denial-of-Service conditions, depending on the network buffer organization in memory. (FSMD-2021-0017)

— MITRE

In Modem ICMP protocol integrated from Nucleus NET TCP/IP software, there is a possible out of bounds write due to a missing bounds check. This could lead to remote information disclosure or denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

— OSV

In Modem TCP protocol integrated from Nucleus NET TCP/IP software, there is a possible out of bounds write due to a missing bounds check. This could lead to remote information disclosure or denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

— OSV

In Modem TCP protocol integrated from Nucleus NET TCP/IP software, there is a possible system crash due to an improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

— OSV

Affected Software

31 affected componentsFixes available
Siemens Capital Vstar
Siemens Nucleus NET
Siemens Nucleus ReadyStart v3<2017.02.4
Siemens Nucleus ReadyStart v4<4.1.1
Siemens Nucleus Source Code
All of the following
Siemens Apogee Modular Building Controller Firmware
Siemens Apogee Modular Building Controller
All of the following
Siemens Apogee Modular Equiment Controller Firmware
Siemens Apogee Modular Equiment Controller
All of the following
Siemens Apogee Pxc Compact Firmware
Siemens Apogee Pxc Compact
All of the following
Siemens Apogee Pxc Modular Firmware
Siemens Apogee Pxc Modular
All of the following
Siemens Talon Tc Compact Firmware
Siemens Talon Tc Compact
All of the following
Siemens Talon Tc Modular Firmware
Siemens Talon Tc Modular
Siemens Apogee Modular Building Controller Firmware
Siemens Apogee Modular Building Controller
Siemens Apogee Modular Equiment Controller Firmware
Siemens Apogee Modular Equiment Controller
Siemens Apogee Pxc Compact Firmware
Siemens Apogee Pxc Compact
Siemens Apogee Pxc Modular Firmware
Siemens Apogee Pxc Modular
Siemens Talon Tc Compact Firmware
Siemens Talon Tc Compact
Siemens Talon Tc Modular Firmware
Siemens Talon Tc Modular
Google Android
android/:unknown:>=SoCVersion:0<SoCVersion:2022-01-05
SoCVersion:2022-01-05

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade android/:unknown: to a version that resolves this vulnerability.

    Fixed in SoCVersion:2022-01-05
  2. Upgrade

    Upgrade APOGEE PXC Compact (BACnet); APOGEE PXC Modular (BACnet); TALON TC Compact (BACnet); TALON TC Modular (BACnet) to a version that resolves this vulnerability.

    Fixed in V3.5.4
  3. Upgrade

    Upgrade APOGEE PXC Compact (P2 Ethernet); APOGEE PXC Modular (P2 Ethernet) to a version that resolves this vulnerability.

    Fixed in V2.8.19
  4. Upgrade

    Upgrade Desigo PXC00-E.D; Desigo PXC00-U; Desigo PXC001-E.D; Desigo PXC100-E.D; Desigo PXC12-E.D; Desigo PXC128-U; Desigo PXC200-E.D; Desigo PXC22-E.D; Desigo PXC22.1-E.D; Desigo PXC36.1-E.D; Desigo PXC50-E.D; Desigo PXC64-U; Desigo PXM20-E to a version that resolves this vulnerability.

    Fixed in V6.30.016
  5. Upgrade

    Upgrade Nucleus ReadyStart V3 to a version that resolves this vulnerability.

    Fixed in V2017.02.4
  6. Upgrade

    Upgrade Nucleus ReadyStart V4 to a version that resolves this vulnerability.

    Fixed in V4.1.1
  7. Upgrade

    Upgrade Capital Embedded AR Classic R20-11 to a version that resolves this vulnerability.

    Fixed in V2303
  8. Upgrade

    Upgrade SIMOTICS CONNECT 400 to a version that resolves this vulnerability.

    Fixed in V1.0.0.0

Event History

Nov 9, 2021
CVE Published
via MITRE·11:32 AM
Data Sourced
via MITRE·11:32 AM
DescriptionSeverityWeakness
Jan 1, 2022
Advisory Published
via OSV·12:00 AM
Data Sourced
via OSV·12:00 AM
DescriptionAffected Software
Jan 4, 2022
Data Sourced
via Android·12:00 AM
SeverityAffected Software

Frequently Asked Questions

1

What is CVE-2021-31890?

CVE-2021-31890 is a vulnerability identified in APOGEE MBC (PPC) (BACnet) and other Siemens software versions.

2

Which software versions are affected by CVE-2021-31890?

All versions of APOGEE MBC (PPC) (BACnet), APOGEE MBC (PPC) (P2 Ethernet), APOGEE MEC (PPC) (BACnet), APOGEE MEC (PPC) (P2 Ethernet), and APOGEE PXC Compact (BACnet) are affected, with APOGEE PXC Compact versions prior to V3.5.4 being vulnerable.

3

How severe is CVE-2021-31890?

CVE-2021-31890 has a severity rating of 9.1 (critical).

4

Where can I find more information about CVE-2021-31890?

You can find more information about CVE-2021-31890 in the Siemens ProductCERT advisories SSA-044112, SSA-114589, and SSA-223353.

5

What is the Common Weakness Enumeration (CWE) associated with CVE-2021-31890?

CVE-2021-31890 is associated with CWE-240.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203