CVE-2021-31885

High

Description

A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.4), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.19), APOGEE PXC Modular (BACnet) (All versions < V3.5.4), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.19), Desigo PXC00-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC00-U (All versions >= V2.3 and < V6.30.016), Desigo PXC001-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC100-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC12-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC128-U (All versions >= V2.3 and < V6.30.016), Desigo PXC200-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC22-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC22.1-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC36.1-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC50-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC64-U (All versions >= V2.3 and < V6.30.016), Desigo PXM20-E (All versions >= V2.3 and < V6.30.016), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.4), Nucleus ReadyStart V4 (All versions < V4.1.1), Nucleus Source Code (All versions), PLUSCONTROL 1st Gen (All versions), TALON TC Compact (BACnet) (All versions < V3.5.4), TALON TC Modular (BACnet) (All versions < V3.5.4). TFTP server application allows for reading the contents of the TFTP memory buffer via sending malformed TFTP commands. (FSMD-2021-0009)

SeverityHigh

CVSS7.5

Exploit probability—

ProductSiemens Nucleus Net

PublishedNov 9, 2021

First seenNov 9, 2021

Weakness typeCWE-805CWE-805

How to fix

Update

siemens nucleus_readystart_v32017.02.4 or later
siemens nucleus_readystart_v44.1.1 or later

Affected products

Product	Affected versions	Fixed in
siemens nucleus_net	No range specified	—
siemens capital_vstar	No range specified	—
siemens nucleus_readystart_v3	v < 2017.02.4	2017.02.4
siemens nucleus_readystart_v4	v < 4.1.1	4.1.1
siemens nucleus_source_code	No range specified	—
siemens apogee_modular_building_controller_firmware	No range specified	—
siemens apogee_modular_equiment_controller_firmware	No range specified	—
siemens apogee_pxc_compact_firmware	No range specified	—
siemens apogee_pxc_modular_firmware	No range specified	—
siemens talon_tc_compact_firmware	No range specified	—
siemens talon_tc_modular_firmware	No range specified	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.