Denial-of-Service Vulnerability in Capital Embedded AR Classic by Siemens

CVE-2021-31883

Summary

A notable vulnerability has been detected within the Capital Embedded AR Classic products, specifically affecting versions 431-422 and R20-11 prior to V2303. This issue arises during the processing of DHCP ACK messages, where the DHCP client fails to properly validate the length of the Vendor option(s). As a result, this oversight may lead to Denial-of-Service conditions, potentially disrupting the availability of network services. Users and organizations utilizing the affected versions are advised to assess their systems and apply best practices to mitigate associated risks.

References