CVE-2021-31890

Vulnerability

The vulnerability exists in the Nucleus NET TCP/IP stack used in multiple Siemens products. The total length of a TCP payload (set in the IP header) is not validated, leading to potential memory corruption. Affected products include Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), PLUSCONTROL 1st Gen (All versions), SIMOTICS CONNECT 400 (All versions < V0.5.0.0), and SIMOTICS CONNECT 400 (All versions < V1.0.0.0) [1][2].

Exploitation

An attacker with network access to an affected device can send a specially crafted TCP packet with an invalid payload length in the IP header. No authentication is required. The unchecked length can cause memory corruption, potentially leading to information disclosure or denial of service. The exact behavior depends on the memory organization [2].

Impact

Successful exploitation can result in information leakage (reading sensitive memory contents) or denial of service (device crash or hang). The impact is high due to the potential for complete compromise of confidentiality or availability [2][description].

Mitigation

Siemens has released updates for some products: SIMOTICS CONNECT 400 update to V0.5.0.0 or V1.0.0.0 [4]; Capital Embedded AR Classic update to V2303 [1]; for PLUSCONTROL 1st Gen, no fix is planned, and workarounds include network segmentation [3]; for other products, refer to SSA-044112. General security recommendations include protecting network access [1].