High ICSA-22-069-02 4 CVEs

Siemens SIMOTICS CONNECT 400

Published Mar 8, 2022 · Updated May 6, 2025 · Revision 2

Vendor: Siemens Product: SIMOTICS CONNECT 400

Summary

Multiple vulnerabilities (also known as “NUCLEUS:13”) have been identified in the Nucleus RTOS (real-time operating system), originally reported in the Siemens Security Advisory SSA-044112: https://cert-portal.siemens.com/productcert/pdf/ssa-044112.pdf.

SIMOTICS CONNECT 400 devices are affected by some of the vulnerabilities as documented below.

Siemens has released an update for the SIMOTICS CONNECT 400 and recommends to update to the latest version.

Vulnerabilities 4

High 8.2

CVE-2021-31346

A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic …

Siemens Capital Embedded AR Classic 431-422 Capital Embedded AR Classic R20-11 SIMOTICS CONNECT 400 ICS / OT

Nov 9, 2021
High 7.5

CVE-2021-31889

A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic …

Siemens Capital Embedded AR Classic 431-422 Capital Embedded AR Classic R20-11 SIMOTICS CONNECT 400 ICS / OT

Nov 9, 2021
High 7.5

CVE-2021-31890

A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic …

Siemens Capital Embedded AR Classic R20-11 Capital Embedded AR Classic 431-422 SIMOTICS CONNECT 400 ICS / OT

Nov 9, 2021
Medium 5.3

CVE-2021-31344

A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic …

Siemens Capital Embedded AR Classic 431-422 Capital Embedded AR Classic R20-11 SIMOTICS CONNECT 400 ICS / OT

Nov 9, 2021

Revision history

2025-05-06 #2
Revision - Fixing typos
2022-03-08 #1
Publication Date

References

SSA-223353: Multiple Vulnerabilities in Nucleus RTOS based SIMOTICS CONNECT 400 - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-223353.txt
SSA-223353: Multiple Vulnerabilities in Nucleus RTOS based SIMOTICS CONNECT 400 - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-223353.pdf
ICS Advisory ICSA-22-069-02 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-22-069-02
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B