DNS Spoofing Vulnerability in APOGEE and Nucleus Products by Siemens
CVE-2021-25677

5.3MEDIUM

Key Information:

Vendor
Siemens
Status
Apogee Pxc Compact (bacnet)
Apogee Pxc Compact (p2 Ethernet)
Apogee Pxc Modular (bacnet)
Apogee Pxc Modular (p2 Ethernet)
Vendor
CVE Published:
22 April 2021

Summary

A significant vulnerability exists in the DNS client of various Siemens products, including the APOGEE and Nucleus series. The issue arises due to improper randomization of DNS transaction IDs, which makes the system susceptible to cache poisoning attacks and DNS spoofing. Attackers can exploit this flaw to manipulate DNS responses, potentially redirecting users to malicious sites or interfering with legitimate DNS operations.

Affected Version(s)

APOGEE PXC Compact (BACnet) All versions < V3.5.5

APOGEE PXC Compact (P2 Ethernet) All versions < V2.8.20

APOGEE PXC Modular (BACnet) All versions < V3.5.5

References

https://cert-portal.siemens.com/productcert/pdf/ssa-70511...
https://cert-portal.siemens.com/productcert/pdf/ssa-66915...
https://cert-portal.siemens.com/productcert/pdf/ssa-18057...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.