What is the CVSS score of CVE-2021-25667?

CVE-2021-25667 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Ruggedcom Rm1224 Firmware are affected by CVE-2021-25667?

A vulnerability has been identified in RUGGEDCOM RM1224 (All versions >= V4.3 and = V4.3 and = V4.3 and < V6.4), SCALANCE.. A patch is available.

Is there a patch available for CVE-2021-25667?

Yes, a patch is available for CVE-2021-25667. Update the affected software to the latest version immediately.

Ruggedcom Rm1224 Firmware CVE-2021-25667

Q: Is there a patch available for CVE-2021-25667?

Yes, a patch is available for CVE-2021-25667. Update the affected software to the latest version immediately.

HIGH

Stack-based Buffer Overflow (CWE-121)

2021-03-15 productcert@siemens.com

Buffer Overflow RCE Stack Overflow Siemens Ruggedcom Rm1224 Firmware Scalance M 800 Firmware Scalance S615 Firmware Scalance X300Wg Firmware Scalance Xm400 Firmware Scalance Xr500 Firmware Scalance Sc622 2C Firmware Scalance Sc632 2C Firmware Scalance Sc636 2C Firmware Scalance Sc642 2C Firmware Scalance Sc646 2C Firmware Scalance Xb 200 Firmware Scalance Xc 200 Firmware Scalance Xf 200Ba Firmware Scalance Xp 200 Firmware

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Mar 15, 2021 - 17:15 cve.org

HIGH 8.8

DescriptionCVE.org

A vulnerability has been identified in RUGGEDCOM RM1224 (All versions >= V4.3 and < V6.4), SCALANCE M-800 (All versions >= V4.3 and < V6.4), SCALANCE S615 (All versions >= V4.3 and < V6.4), SCALANCE SC-600 Family (All versions >= V2.0 and < V2.1.3), SCALANCE XB-200 (All versions < V4.1), SCALANCE XC-200 (All versions < V4.1), SCALANCE XF-200BA (All versions < V4.1), SCALANCE XM400 (All versions < V6.2), SCALANCE XP-200 (All versions < V4.1), SCALANCE XR-300WG (All versions < V4.1), SCALANCE XR500 (All versions < V6.2). Affected devices contain a stack-based buffer overflow vulnerability in the handling of STP BPDU frames that could allow a remote attacker to trigger a denial-of-service condition or potentially remote code execution. Successful exploitation requires the passive listening feature of the device to be active.

AnalysisAI

Technical ContextAI

This vulnerability is classified under CWE-121. A vulnerability has been identified in RUGGEDCOM RM1224 (All versions >= V4.3 and < V6.4), SCALANCE M-800 (All versions >= V4.3 and < V6.4), SCALANCE S615 (All versions >= V4.3 and < V6.4), SCALANCE SC-600 Family (All versions >= V2.0 and < V2.1.3), SCALANCE XB-200 (All versions < V4.1), SCALANCE XC-200 (All versions < V4.1), SCALANCE XF-200BA (All versions < V4.1), SCALANCE XM400 (All versions < V6.2), SCALANCE XP-200 (All versions < V4.1), SCALANCE XR-300WG (All versions < V4.1), SCALANCE XR500 (All versions < V6.2). Affected devices contain a stack-based buffer overflow vulnerability in the handling of STP BPDU frames that could allow a remote attacker to trigger a denial-of-service condition or potentially remote code execution. Successful exploitation requires the passive listening feature of the device to be active. Affected products include: Siemens Ruggedcom Rm1224 Firmware, Siemens Scalance M-800 Firmware, Siemens Scalance S615 Firmware, Siemens Scalance X300Wg Firmware, Siemens Scalance Xm400 Firmware.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.