Skip to content
Fencer Vulns
medium 5.3

CVE-2021-31344 json

A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions…

published 2021-11-09 4 y ago modified 2026-06-17 4 mo ago also EUVD-2021-18254

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.5%
EPSS 1.5% chance of exploitation in 30 days, percentile 73%
public exploits
0
none known

Summary

A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), PLUSCONTROL 1st Gen (All versions), SIMOTICS CONNECT 400 (All versions < V0.5.0.0), SIMOTICS CONNECT 400 (All versions < V1.0.0.0). ICMP echo packets with fake IP options allow sending ICMP echo reply messages to arbitrary hosts on the network. (FSMD-2021-0004)

Patch / fix

  • Siemens Capital Embedded AR Classic R20-11 V2303

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-21-313-03 updated cvss 5.3

Siemens Nucleus RTOS TCP/IP Stack

  • Siemens Nucleus NET
    affected: mitigation, no fix planned
  • Siemens Nucleus ReadyStart V3 <V2017.02.4
    affected: fixed in V2017.02.4 support.sw.siemens.com
  • Siemens Nucleus ReadyStart V4 <V4.1.1
    affected: fixed in V4.1.1 support.sw.siemens.com
  • Siemens Nucleus Source Code
    affected: vendor fix

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-21-315-07 updated cvss 5.3

Siemens Nucleus RTOS-based APOGEE and TALON Products (Update C)

  • Siemens APOGEE MBC (PPC) (BACnet) Siemens APOGEE MBC (PPC) (P2 Ethernet) Siemens APOGEE MEC (PPC) (BACnet) Siemens APOGEE MEC (PPC) (P2 Ethernet)
    affected: mitigation, no fix planned
  • Siemens APOGEE PXC Compact (BACnet) <V3.5.4
    affected: fixed in V3.5.4, mitigation
  • Siemens APOGEE PXC Compact (P2 Ethernet) <V2.8.19
    affected: fixed in V2.8.19, mitigation
  • Siemens APOGEE PXC Modular (BACnet) <V3.5.4
    affected: fixed in V3.5.4, mitigation
  • Siemens APOGEE PXC Modular (P2 Ethernet) <V2.8.19
    affected: fixed in V2.8.19, mitigation
  • Siemens Desigo PXC00-E.D >=V2.3_and_<V6.30.016 Siemens Desigo PXC00-U >=V2.3_and_<V6.30.016 Siemens Desigo PXC001-E.D >=V2.3_and_<V6.30.016 Siemens Desigo PXC12-E.D >=V2.3_and_<V6.30.016 Siemens Desigo PXC22-E.D >=V2.3_and_<V6.30.016 Siemens Desigo PXC22.1-E.D >=V2.3_and_<V6.30.016
    +7 more products
    Siemens Desigo PXC36.1-E.D >=V2.3_and_<V6.30.016 Siemens Desigo PXC50-E.D >=V2.3_and_<V6.30.016 Siemens Desigo PXC64-U >=V2.3_and_<V6.30.016 Siemens Desigo PXC100-E.D >=V2.3_and_<V6.30.016 Siemens Desigo PXC128-U >=V2.3_and_<V6.30.016 Siemens Desigo PXC200-E.D >=V2.3_and_<V6.30.016 Siemens Desigo PXM20-E >=V2.3_and_<V6.30.016
    affected: fixed in V6.30.016, mitigation support.industry.siemens.com
  • Siemens TALON TC Compact (BACnet) <V3.5.4 Siemens TALON TC Modular (BACnet) <V3.5.4
    affected: fixed in V3.5.4, mitigation

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-21-350-06 updated cvss 5.3

Siemens Capital VSTAR

  • Siemens Capital Embedded AR Classic 431-422
    affected: mitigation, no fix planned
  • Siemens Capital Embedded AR Classic R20-11 <V2303
    affected: fixed in V2303, mitigation

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-22-013-03 updated cvss 5.3

Siemens Energy PLUSCONTROL

  • Siemens PLUSCONTROL 1st Gen
    affected: mitigation, no fix planned

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-22-069-02 updated cvss 5.3

Siemens SIMOTICS CONNECT 400

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Exploit prediction

1.46% chance of exploitation in the next 30 days, higher than 73% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CNA 4.0 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CNA 4.0 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:N

Affected products

  • Siemens Capital Embedded AR Classic 431-422
  • Siemens Capital Embedded AR Classic R20-11
  • Siemens PLUSCONTROL 1st Gen
  • Siemens SIMOTICS CONNECT 400

Classification

Weakness
  • CWE-843 Access of Resource Using Incompatible Type

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.