Description
A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303). The DHCP client application does not validate the length of the Domain Name Server IP option(s) (0x06) when processing DHCP ACK packets. This may lead to Denial-of-Service conditions. (FSMD-2021-0011)
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Siemens | Capital Embedded AR Classic 431-422 | — | — |
| Siemens | Capital Embedded AR Classic R20-11 | < V2303 | V2303 |
Advisories 8
- VDE-2021-059 PHOENIX CONTACT: BLUEMARK X1 / LED / CLED printers utilizing the Siemens Nucleus RTOS TCP/IP Stack CERT@VDE · May 22, 2025
- ICSA-21-350-06 Siemens Capital VSTAR CISA ICS & IT advisories · May 6, 2025
- ICSA-21-315-07 Siemens Nucleus RTOS-based APOGEE and TALON Products (Update C) CISA ICS & IT advisories · May 6, 2025
- ICSA-21-313-03 Siemens Nucleus RTOS TCP/IP Stack CISA ICS & IT advisories · May 6, 2025
- SSA-620288 SSA-620288: Multiple Vulnerabilities (NUCLEUS:13) in Capital Embedded AR Classic Siemens ProductCERT · Mar 11, 2025
- SSA-114589 SSA-114589: Multiple Vulnerabilities in Nucleus RTOS based APOGEE, TALON and Desigo PXC/PXM Products Siemens ProductCERT · May 10, 2022
- SSA-044112 SSA-044112: Multiple Vulnerabilities (NUCLEUS:13) in the TCP/IP Stack of Nucleus RTOS Siemens ProductCERT · Dec 14, 2021
- VDE-2021-050 WAGO: Multiple devices affected by Vulnerabilities in NUCLEUS TCP Stack. CERT@VDE · Nov 16, 2021
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-114589.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-044112.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-620288.pdf
- https://cert-portal.siemens.com/productcert/html/ssa-114589.html
- https://cert-portal.siemens.com/productcert/html/ssa-044112.html
- https://cert-portal.siemens.com/productcert/html/ssa-620288.html