Skip to content
Fencer Vulns
high 7.5

CVE-2021-25664 json

A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions…

published 2021-04-22 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-12556

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.9%
EPSS 1.9% chance of exploitation in 30 days, percentile 79%
public exploits
0
none known

Summary

A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.4), Nucleus ReadyStart V4 (All versions < V4.1.0), Nucleus Source Code (All versions including affected IPv6 stack). The function that processes the Hop-by-Hop extension header in IPv6 packets and its options lacks any checks against the length field of the header, allowing attackers to put the function into an infinite loop by supplying arbitrary length values.

Patch / fix

  • Siemens Capital Embedded AR Classic R20-11 V2303
  • Siemens Nucleus ReadyStart V3 V2017.02.4
  • Siemens Nucleus ReadyStart V4 V4.1.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-21-103-05 updated cvss 7.5

Siemens Nucleus Products IPv6 Stack

  • Siemens Capital Embedded AR Classic 431-422
    affected: mitigation, no fix planned
  • Siemens Capital Embedded AR Classic R20-11 < V2303
    affected: fixed in V2303, mitigation
  • Siemens Nucleus NET
    affected: mitigation, no fix planned
  • Siemens Nucleus ReadyStart V3 < V2017.02.4
    affected: fixed in V2017.02.4
  • Siemens Nucleus ReadyStart V4 < V4.1.0
    affected: fixed in V4.1.0
  • Siemens Nucleus Source Code
    affected: vendor fix

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Exploit prediction

1.88% chance of exploitation in the next 30 days, higher than 79% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P

Affected products

  • Siemens Capital Embedded AR Classic 431-422
  • Siemens Capital Embedded AR Classic R20-11
  • Siemens Nucleus NET
  • Siemens Nucleus ReadyStart V3
  • Siemens Nucleus ReadyStart V4
  • Siemens Nucleus Source Code

Classification

Weakness
  • CWE-835 Loop with Unreachable Exit Condition

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.