CVE-2021-25667

15.03.2021, 17:15

A vulnerability has been identified in RUGGEDCOM RM1224 (All versions >= V4.3 and < V6.4), SCALANCE M-800 (All versions >= V4.3 and < V6.4), SCALANCE S615 (All versions >= V4.3 and < V6.4), SCALANCE SC-600 Family (All versions >= V2.0 and < V2.1.3), SCALANCE XB-200 (All versions < V4.1), SCALANCE XC-200 (All versions < V4.1), SCALANCE XF-200BA (All versions < V4.1), SCALANCE XM400 (All versions < V6.2), SCALANCE XP-200 (All versions < V4.1), SCALANCE XR-300WG (All versions < V4.1), SCALANCE XR500 (All versions < V6.2). Affected devices contain a stack-based buffer overflow vulnerability in the handling of STP BPDU frames that could allow a remote attacker to trigger a denial-of-service condition or potentially remote code execution. Successful exploitation requires the passive listening feature of the device to be active.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	8.8 HIGH	ADJACENT_NETWORK	LOW	NONE	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
siemens	CNA	---				---
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 74%

Vendor	Product	Version
siemens	ruggedcom_rm1224_firmware	4.3 ≤ 𝑥 < 6.4
siemens	scalance_m-800_firmware	4.3 ≤ 𝑥 < 6.4
siemens	scalance_s615_firmware	4.3 ≤ 𝑥 < 6.4
siemens	scalance_x300wg_firmware	𝑥 < 4.1
siemens	scalance_xm400_firmware	𝑥 < 6.2
siemens	scalance_xr500_firmware	𝑥 < 6.2
siemens	scalance_sc622-2c_firmware	𝑥 ≤ 2.0
siemens	scalance_sc622-2c_firmware	2.1 ≤ 𝑥 < 2.1.3
siemens	scalance_sc632-2c_firmware	𝑥 ≤ 2.0
siemens	scalance_sc632-2c_firmware	2.1 ≤ 𝑥 < 2.1.3
siemens	scalance_sc636-2c_firmware	𝑥 ≤ 2.0
siemens	scalance_sc636-2c_firmware	2.1 ≤ 𝑥 < 2.1.3
siemens	scalance_sc642-2c_firmware	𝑥 ≤ 2.0
siemens	scalance_sc642-2c_firmware	2.1 ≤ 𝑥 < 2.1.3
siemens	scalance_sc646-2c_firmware	𝑥 ≤ 2.0
siemens	scalance_sc646-2c_firmware	2.1 ≤ 𝑥 < 2.1.3
siemens	scalance_xb-200_firmware	𝑥 < 4.1
siemens	scalance_xc-200_firmware	𝑥 < 4.1
siemens	scalance_xf-200ba_firmware	𝑥 < 4.1
siemens	scalance_xp-200_firmware	𝑥 < 4.1

𝑥

= Vulnerable software versions

Common Weakness Enumeration

References

https://cert-portal.siemens.com/productcert/pdf/ssa-979775.pdf

https://us-cert.cisa.gov/ics/advisories/icsa-21-068-03

https://cert-portal.siemens.com/productcert/pdf/ssa-979775.pdf

https://us-cert.cisa.gov/ics/advisories/icsa-21-068-03