CVE-2021-25677 vulnerability in Siemens Products
Published on April 22, 2021
A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (All versions < V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.20), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.3), Nucleus ReadyStart V3 (All versions < V2017.02.4), Nucleus ReadyStart V4 (All versions < V4.1.0), Nucleus Source Code (Versions including affected DNS modules), SIMOTICS CONNECT 400 (All versions < V0.5.0.0), SIMOTICS CONNECT 400 (All versions >= V0.5.0.0 < V1.0.0.0), TALON TC Compact (BACnet) (All versions < V3.5.5), TALON TC Modular (BACnet) (All versions < V3.5.5). The DNS client does not properly randomize DNS transaction IDs. That could allow an attacker to poison the DNS cache or spoof DNS resolving.
Weakness Type
Use of Insufficiently Random Values
The software uses insufficiently random numbers or values in a security context that depends on unpredictable numbers. When software generates predictable values in a context requiring unpredictability, it may be possible for an attacker to guess the next value that will be generated, and use this guess to impersonate another user or access sensitive information.
Products Associated with CVE-2021-25677
Want to know whenever a new CVE is published for Siemens products? stack.watch will email you.
Affected Versions
Siemens APOGEE PXC Compact (BACnet):- Version All versions < V3.5.5 is affected.
- Version All versions < V2.8.20 is affected.
- Version All versions < V3.5.5 is affected.
- Version All versions < V2.8.20 is affected.
- Version All versions is affected.
- Version All versions < V2017.02.3 is affected.
- Version All versions < V2017.02.4 is affected.
- Version All versions < V4.1.0 is affected.
- Version Versions including affected DNS modules is affected.
- Version All versions < V0.5.0.0 is affected.
- Version All versions >= V0.5.0.0 < V1.0.0.0 is affected.
- Version All versions < V3.5.5 is affected.
- Version All versions < V3.5.5 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.