ICMP Payload Vulnerability in Capital Embedded AR and SIMOTICS CONNECT Products

CVE-2021-31346

Summary

A vulnerability affecting various Siemens products, including Capital Embedded AR Classic and SIMOTICS CONNECT, arises from insufficient validation of the total length of an ICMP payload specified in the IP header. This oversight could potentially lead to information leaks or Denial-of-Service scenarios, contingent upon the specific setup of the network buffer in memory. Users should be aware of the conditions that allow these issues to manifest and take appropriate action to secure their systems.

References