Skip to content
Fencer Vulns
high 7.1

CVE-2021-31883 json

A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions…

published 2021-11-09 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-18758

cvss
7.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.5%
EPSS 1.5% chance of exploitation in 30 days, percentile 74%
public exploits
0
none known

Summary

A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303). When processing a DHCP ACK message, the DHCP client application does not validate the length of the Vendor option(s), leading to Denial-of-Service conditions. (FSMD-2021-0013)

Patch / fix

  • Siemens Capital Embedded AR Classic R20-11 V2303

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-21-313-03 updated cvss 7.1

Siemens Nucleus RTOS TCP/IP Stack

  • Siemens Nucleus NET
    affected: mitigation, no fix planned
  • Siemens Nucleus ReadyStart V3 <V2017.02.4
    affected: fixed in V2017.02.4 support.sw.siemens.com
  • Siemens Nucleus Source Code
    affected: vendor fix

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-21-315-07 updated cvss 7.1

Siemens Nucleus RTOS-based APOGEE and TALON Products (Update C)

  • Siemens APOGEE MBC (PPC) (BACnet) Siemens APOGEE MBC (PPC) (P2 Ethernet) Siemens APOGEE MEC (PPC) (BACnet) Siemens APOGEE MEC (PPC) (P2 Ethernet)
    affected: mitigation, no fix planned
  • Siemens APOGEE PXC Compact (BACnet) <V3.5.4
    affected: fixed in V3.5.4, mitigation
  • Siemens APOGEE PXC Compact (P2 Ethernet) <V2.8.19
    affected: fixed in V2.8.19, mitigation
  • Siemens APOGEE PXC Modular (BACnet) <V3.5.4
    affected: fixed in V3.5.4, mitigation
  • Siemens APOGEE PXC Modular (P2 Ethernet) <V2.8.19
    affected: fixed in V2.8.19, mitigation
  • Siemens Desigo PXC00-E.D >=V2.3_and_<V6.30.016 Siemens Desigo PXC00-U >=V2.3_and_<V6.30.016 Siemens Desigo PXC001-E.D >=V2.3_and_<V6.30.016 Siemens Desigo PXC12-E.D >=V2.3_and_<V6.30.016 Siemens Desigo PXC22-E.D >=V2.3_and_<V6.30.016 Siemens Desigo PXC22.1-E.D >=V2.3_and_<V6.30.016
    +7 more products
    Siemens Desigo PXC36.1-E.D >=V2.3_and_<V6.30.016 Siemens Desigo PXC50-E.D >=V2.3_and_<V6.30.016 Siemens Desigo PXC64-U >=V2.3_and_<V6.30.016 Siemens Desigo PXC100-E.D >=V2.3_and_<V6.30.016 Siemens Desigo PXC128-U >=V2.3_and_<V6.30.016 Siemens Desigo PXC200-E.D >=V2.3_and_<V6.30.016 Siemens Desigo PXM20-E >=V2.3_and_<V6.30.016
    affected: fixed in V6.30.016, mitigation support.industry.siemens.com
  • Siemens TALON TC Compact (BACnet) <V3.5.4 Siemens TALON TC Modular (BACnet) <V3.5.4
    affected: fixed in V3.5.4, mitigation

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-21-350-06 updated cvss 7.1

Siemens Capital VSTAR

  • Siemens Capital Embedded AR Classic 431-422
    affected: mitigation, no fix planned
  • Siemens Capital Embedded AR Classic R20-11 <V2303
    affected: fixed in V2303, mitigation

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Exploit prediction

1.53% chance of exploitation in the next 30 days, higher than 74% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.1 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P

Affected products

  • Siemens Capital Embedded AR Classic 431-422
  • Siemens Capital Embedded AR Classic R20-11

Classification

Weakness
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.