CVE-2021-25663

Vulnerability

An infinite-loop vulnerability exists in the IPv6 header-processing function of Siemens Nucleus products, including Capital Embedded AR Classic 431-422 (all versions), Capital Embedded AR Classic R20-11 (all versions prior to V2303), Nucleus NET (all versions), Nucleus ReadyStart V3 (versions prior to V2017.02.4), Nucleus ReadyStart V4 (versions prior to V4.1.0), and Nucleus Source Code (versions including the affected IPv6 stack) [1]. The flaw occurs because the function lacks checks on the lengths of IPv6 extension header options, allowing an attacker to craft a packet with a length value that causes the function to loop indefinitely [1]. This is classified as CWE-835 (Loop with Unreachable Exit Condition) [1].

Exploitation

An unauthenticated attacker can exploit this vulnerability remotely without any special privileges or user interaction [1]. The attacker sends a single IPv6 packet with a crafted extension header that contains an option length field set to a value that triggers the infinite loop [1]. The attack has low complexity and does not require authentication or knowledge of the target [1]. No race conditions or special network position beyond standard IPv6 connectivity are needed.

Impact

Successful exploitation causes the target device to enter an infinite loop, leading to a denial-of-service (DoS) condition [1]. The impact is limited to availability (C:N/I:N/A:H); no data is compromised or modified, and no code execution is achieved [1]. The CVSS v3 base score is 7.5 (High) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H [1]. For Capital Embedded AR Classic 431-422, no fix is planned [2].

Mitigation

For Nucleus ReadyStart V3, the fix was released in version V2017.02.4 [2]. For Nucleus ReadyStart V4, the fix was released in version V4.1.0 [2]. For Capital Embedded AR Classic R20-11, the fix is available in version V2303 [2]. For Capital Embedded AR Classic 431-422, Siemens has stated that no fix is planned as of the last advisory update [2]. For Nucleus NET and other affected products, users should consult Siemens advisory SSA-248289 for tailored updates and workarounds [2]. No workaround is described in the available references for unpatched versions, and the vulnerability is not listed in KEV (Known Exploited Vulnerabilities) at the time of publication.