CVE-2021-31346

Vulnerability

The vulnerability exists in the Nucleus RTOS TCP/IP stack, where the total length of an ICMP payload set in the IP header is not checked. This affects Capital Embedded AR Classic 431-422 (all versions), Capital Embedded AR Classic R20-11 (all versions < V2303), PLUSCONTROL 1st Gen (all versions), and SIMOTICS CONNECT 400 (all versions < V0.5.0.0 and < V1.0.0.0) [1][2][3][4].

Exploitation

An attacker with network access can send a specially crafted ICMP packet with an excessive payload length. No authentication is required, and the unchecked length may cause memory corruption or buffer overflow, depending on the network buffer organization. User interaction is not needed.

Impact

Successful exploitation can lead to information leakage (disclosure of sensitive memory contents) and denial-of-service conditions (device crashes or unresponsiveness). The impact primarily affects confidentiality and availability; integrity is not directly compromised.

Mitigation

Siemens has released updates for SIMOTICS CONNECT 400 to versions V0.5.0.0 and V1.0.0.0 [4]. For Capital Embedded AR Classic and PLUSCONTROL 1st Gen, no fix is currently planned [1][3]. As workarounds, network segmentation and restricting access to trusted networks are recommended. For Nucleus RTOS products, updating the Nucleus NET stack may mitigate the issue [2].