Siemens Energy PLUSCONTROL Multiple Vulnerabilities Advisory (CVE-2021-31344/31345/31346/31885/31889/31890)

From this webpage screenshot, the following key vulnerability information can be obtained: 1. Vulnerability ID: SSA-845392 2. Affected Product: Nucleus RTOS based on Siemens Energy PLUSCONTROL 1st Gen devices 3. Vulnerability Types: - ICMP echo packets with fake IP options (CVE-2021-31344) - Unchecked total length of a UDP payload (CVE-2021-31345) - Unchecked total length of an ICMP payload (CVE-2021-31346) - TFTP server application (CVE-2021-31885) - Malformed TCP packets with a corrupted SACK option (CVE-2021-31889) - Unchecked total length of a TCP payload (CVE-2021-31890) 4. Vulnerability Scores: - CVSS v3.1 Base Score: 5.3 (CVE-2021-31344) - CVSS v3.1 Base Score: 7.5 (CVE-2021-31345, CVE-2021-31346, CVE-2021-31885, CVE-2021-31889, CVE-2021-31890) 5. Affected Versions: All versions 6. Recommended Actions: - Review network layer security measures to prevent access from other network segments. - Use appropriate tools and documented procedures to apply security updates. - Validate security updates before deployment and supervise the update process with trained personnel. - Protect network access using mechanisms such as firewalls, segmentation, and VPNs. 7. Product Description: PLUSCONTROL products are control devices from Siemens Energy, used for high-power energy transmission, featuring modular multilevel converters. 8. Vulnerability Classification: - Classified using the CVSS scoring system. - Classified using CWE (Common Weakness Enumeration), a community-developed list of software security weaknesses. This information helps in understanding the nature, scope of impact, and mitigation measures for the vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

Siemens Energy PLUSCONTROL Multiple Vulnerabilities Advisory (CVE-2021-31344/31345/31346/31885/31889/31890)