Skip to content
OpenAdvisories
High SSA-248289 2 CVEs

SSA-248289: Denial of Service Vulnerabilities in the IPv6 Stack of Nucleus RTOS

Published Apr 13, 2021 · Updated Mar 11, 2025 · Revision 4

Vendor: Siemens Product: Capital Embedded AR Classic 431-422 Product: Capital Embedded AR Classic R20-11 Product: Nucleus NET Product: Nucleus ReadyStart V3 Product: Nucleus ReadyStart V4 Product: Nucleus Source Code

Summary

The IPv6 stack of the networking component (Nucleus NET) in Nucleus Real-Time Operating System (RTOS) contains two vulnerabilities when processing IPv6 headers which could allow an attacker to cause a denial of service condition.

Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends countermeasures for products where fixes are not, or not yet available.

Vulnerabilities 2

Revision history

  1. #4

    Updated remediation of Capital Embedded AR Classic 431-422 as no fix planned

  2. #3

    Renamed Capital VSTAR to Capital Embedded AR Classic; added fix and mitigation for Capital Embedded AR Classic; added CVSSv4.0 vector and score

  3. #2

    Added solution for Nucleus ReadyStart V3; consolidated list of products

  4. #1

    Publication Date

References