Skip to content
Fencer Vulns
high 8.2

CVE-2021-31346 json

A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions…

published 2021-11-09 4 y ago modified 2026-06-17 4 mo ago also EUVD-2021-18256

cvss
8.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.0%
EPSS 2.0% chance of exploitation in 30 days, percentile 80%
public exploits
0
none known

Summary

A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), PLUSCONTROL 1st Gen (All versions), SIMOTICS CONNECT 400 (All versions < V0.5.0.0), SIMOTICS CONNECT 400 (All versions < V1.0.0.0). The total length of an ICMP payload (set in the IP header) is unchecked. This may lead to various side effects, including Information Leak and Denial-of-Service conditions, depending on the network buffer organization in memory. (FSMD-2021-0007)

Patch / fix

  • Siemens Capital Embedded AR Classic R20-11 V2303

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-21-313-03 updated cvss 8.2

Siemens Nucleus RTOS TCP/IP Stack

  • Siemens Nucleus NET
    affected: mitigation, no fix planned
  • Siemens Nucleus ReadyStart V3 <V2017.02.4
    affected: fixed in V2017.02.4 support.sw.siemens.com
  • Siemens Nucleus ReadyStart V4 <V4.1.1
    affected: fixed in V4.1.1 support.sw.siemens.com
  • Siemens Nucleus Source Code
    affected: vendor fix

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-21-315-07 updated cvss 8.2

Siemens Nucleus RTOS-based APOGEE and TALON Products (Update C)

  • Siemens APOGEE MBC (PPC) (BACnet) Siemens APOGEE MBC (PPC) (P2 Ethernet) Siemens APOGEE MEC (PPC) (BACnet) Siemens APOGEE MEC (PPC) (P2 Ethernet)
    affected: mitigation, no fix planned
  • Siemens APOGEE PXC Compact (BACnet) <V3.5.4
    affected: fixed in V3.5.4, mitigation
  • Siemens APOGEE PXC Compact (P2 Ethernet) <V2.8.19
    affected: fixed in V2.8.19, mitigation
  • Siemens APOGEE PXC Modular (BACnet) <V3.5.4
    affected: fixed in V3.5.4, mitigation
  • Siemens APOGEE PXC Modular (P2 Ethernet) <V2.8.19
    affected: fixed in V2.8.19, mitigation
  • Siemens Desigo PXC00-E.D >=V2.3_and_<V6.30.016 Siemens Desigo PXC00-U >=V2.3_and_<V6.30.016 Siemens Desigo PXC001-E.D >=V2.3_and_<V6.30.016 Siemens Desigo PXC12-E.D >=V2.3_and_<V6.30.016 Siemens Desigo PXC22-E.D >=V2.3_and_<V6.30.016 Siemens Desigo PXC22.1-E.D >=V2.3_and_<V6.30.016
    +7 more products
    Siemens Desigo PXC36.1-E.D >=V2.3_and_<V6.30.016 Siemens Desigo PXC50-E.D >=V2.3_and_<V6.30.016 Siemens Desigo PXC64-U >=V2.3_and_<V6.30.016 Siemens Desigo PXC100-E.D >=V2.3_and_<V6.30.016 Siemens Desigo PXC128-U >=V2.3_and_<V6.30.016 Siemens Desigo PXC200-E.D >=V2.3_and_<V6.30.016 Siemens Desigo PXM20-E >=V2.3_and_<V6.30.016
    affected: fixed in V6.30.016, mitigation support.industry.siemens.com
  • Siemens TALON TC Compact (BACnet) <V3.5.4 Siemens TALON TC Modular (BACnet) <V3.5.4
    affected: fixed in V3.5.4, mitigation

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-21-350-06 updated cvss 8.2

Siemens Capital VSTAR

  • Siemens Capital Embedded AR Classic 431-422
    affected: mitigation, no fix planned
  • Siemens Capital Embedded AR Classic R20-11 <V2303
    affected: fixed in V2303, mitigation

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-22-013-03 updated cvss 8.2

Siemens Energy PLUSCONTROL

  • Siemens PLUSCONTROL 1st Gen
    affected: mitigation, no fix planned

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-22-069-02 updated cvss 8.2

Siemens SIMOTICS CONNECT 400

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Exploit prediction

1.97% chance of exploitation in the next 30 days, higher than 80% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
NVD 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
NVD 2.0 6.4 AV:N/AC:L/Au:N/C:P/I:N/A:P

Affected products

  • Siemens Capital Embedded AR Classic 431-422
  • Siemens Capital Embedded AR Classic R20-11
  • Siemens PLUSCONTROL 1st Gen
  • Siemens SIMOTICS CONNECT 400

Classification

Weakness
  • CWE-1284 Improper Validation of Specified Quantity in Input

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.