CVE-2021-41545
High
Description
A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02.20.142.10-10884). When the controller receives a specific BACnet protocol packet, an exception causes the BACnet communication function to go into a “out of work” state and could result in the controller going into a “factory reset” state.
SeverityHigh
CVSS7.5
Exploit probability—
ProductSiemens Desigo Dxr2 Firmware
PublishedMay 10, 2022
First seenMay 10, 2022
Weakness typeCWE-248CWE-248
How to fix
Update
- siemens desigo_dxr2_firmware01.21.142.5-22 or later
- siemens desigo_pxc3_firmware01.21.142.4-18 or later
- siemens desigo_pxc4_firmware02.20.142.10-10884 or later
- siemens desigo_pxc5_firmware02.20.142.10-10884 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| siemens desigo_dxr2_firmware | v < 01.21.142.5-22 | 01.21.142.5-22 |
| siemens desigo_pxc3_firmware | v < 01.21.142.4-18 | 01.21.142.4-18 |
| siemens desigo_pxc4_firmware | v < 02.20.142.10-10884 | 02.20.142.10-10884 |
| siemens desigo_pxc5_firmware | v < 02.20.142.10-10884 | 02.20.142.10-10884 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.