{
  "document": {
    "title": "SSA-223353: Multiple Vulnerabilities in Nucleus RTOS based SIMOTICS CONNECT 400",
    "category": "Siemens Security Advisory",
    "csaf_version": "2.0",
    "publisher": {
      "name": "Siemens ProductCERT",
      "contact_details": "productcert@siemens.com",
      "category": "vendor",
      "namespace": "https://www.siemens.com"
    },
    "distribution": {
      "text": "Disclosure is not limited.",
      "tlp": {
        "label": "WHITE"
      }
    },
    "tracking": {
      "id": "SSA-223353",
      "status": "final",
      "version": "1",
      "revision_history": [
        {
          "number": "1",
          "legacy_version": "1.0",
          "date": "2022-03-08T00:00:00Z",
          "summary": "Publication Date"
        }
      ],
      "initial_release_date": "2022-03-08T00:00:00Z",
      "current_release_date": "2022-03-08T00:00:00Z",
      "generator": {
        "engine": {
          "name": "Siemens ProductCERT CSAF Generator",
          "version": "1"
        }
      }
    },
    "notes": [
      {
        "title": "Summary",
        "category": "summary",
        "text": "Multiple vulnerabilities (also known as “NUCLEUS:13”) have been identified in the Nucleus RTOS (real-time operating system), originally reported in the Siemens Security Advisory SSA-044112: https://cert-portal.siemens.com/productcert/pdf/ssa-044112.pdf.\n\nSIMOTICS CONNECT 400 devices are affected by some of the vulnerabilities as documented below.\n\nSiemens has released an update for the SIMOTICS CONNECT 400 and recommends to update to the latest version."
      },
      {
        "title": "General Recommendations",
        "category": "general",
        "text": "As a general security measure Siemens strongly recommends to protect network access to affected products with appropriate mechanisms. It is advised to follow recommended security practices in order to run the devices in a protected IT environment."
      },
      {
        "title": "Additional Resources",
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories"
      },
      {
        "title": "Terms of Use",
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens' underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens' Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use."
      }
    ],
    "references": [
      {
        "category": "self",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-223353.pdf",
        "summary": "SSA-223353: Multiple Vulnerabilities in Nucleus RTOS based SIMOTICS CONNECT 400 - PDF Version"
      },
      {
        "category": "self",
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-223353.txt",
        "summary": "SSA-223353: Multiple Vulnerabilities in Nucleus RTOS based SIMOTICS CONNECT 400 - TXT Version"
      },
      {
        "category": "self",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-223353.json",
        "summary": "SSA-223353: Multiple Vulnerabilities in Nucleus RTOS based SIMOTICS CONNECT 400 - CSAF Version"
      }
    ]
  },
  "product_tree": {
    "branches": [
      {
        "name": "Siemens",
        "category": "vendor",
        "branches": [
          {
            "name": "SIMOTICS CONNECT 400",
            "category": "product_name",
            "branches": [
              {
                "name": "< V0.5.0.0",
                "category": "product_version_range",
                "product": {
                  "product_id": "1",
                  "name": "SIMOTICS CONNECT 400"
                }
              }
            ]
          },
          {
            "name": "SIMOTICS CONNECT 400",
            "category": "product_name",
            "branches": [
              {
                "name": "< V1.0.0.0",
                "category": "product_version_range",
                "product": {
                  "product_id": "2",
                  "name": "SIMOTICS CONNECT 400"
                }
              }
            ]
          }
        ]
      }
    ]
  },
  "vulnerabilities": [
    {
      "title": "CVE-2021-31344",
      "notes": [
        {
          "title": "Summary",
          "category": "summary",
          "text": "ICMP echo packets with fake IP options allow sending ICMP echo reply messages to arbitrary hosts on the network. (FSMD-2021-0004)"
        }
      ],
      "cve": "CVE-2021-31344",
      "cwe": {
        "id": "CWE-843",
        "name": "Access of Resource Using Incompatible Type ('Type Confusion')"
      },
      "product_status": {
        "known_affected": [
          "1",
          "2"
        ]
      },
      "scores": [
        {
          "cvss_v3": {
            "version": "3.1",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C"
          },
          "products": [
            "1",
            "2"
          ]
        }
      ],
      "remediations": [
        {
          "product_ids": [
            "1"
          ],
          "category": "vendor_fix",
          "details": "Update to V0.5.0.0 or later version",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109778383/"
        },
        {
          "product_ids": [
            "2"
          ],
          "category": "vendor_fix",
          "details": "Update to V1.0.0.0 or later version",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109778383/"
        }
      ],
      "references": [
        {
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109778383/",
          "summary": "CVE-2021-31344 - SIMOTICS CONNECT 400"
        },
        {
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109778383/",
          "summary": "CVE-2021-31344 - SIMOTICS CONNECT 400"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-31344.json",
          "summary": "CVE-2021-31344 Mitre 5.0 json"
        }
      ]
    },
    {
      "title": "CVE-2021-31346",
      "notes": [
        {
          "title": "Summary",
          "category": "summary",
          "text": "The total length of an ICMP payload (set in the IP header) is unchecked. This may lead to various side effects, including Information Leak and Denial-of-Service conditions, depending on the network buffer organization in memory. (FSMD-2021-0007)"
        }
      ],
      "cve": "CVE-2021-31346",
      "cwe": {
        "id": "CWE-1284",
        "name": "Improper Validation of Specified Quantity in Input"
      },
      "product_status": {
        "known_affected": [
          "1",
          "2"
        ]
      },
      "scores": [
        {
          "cvss_v3": {
            "version": "3.1",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H/E:P/RL:O/RC:C"
          },
          "products": [
            "1",
            "2"
          ]
        }
      ],
      "remediations": [
        {
          "product_ids": [
            "1"
          ],
          "category": "vendor_fix",
          "details": "Update to V0.5.0.0 or later version",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109778383/"
        },
        {
          "product_ids": [
            "2"
          ],
          "category": "vendor_fix",
          "details": "Update to V1.0.0.0 or later version",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109778383/"
        }
      ],
      "references": [
        {
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109778383/",
          "summary": "CVE-2021-31346 - SIMOTICS CONNECT 400"
        },
        {
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109778383/",
          "summary": "CVE-2021-31346 - SIMOTICS CONNECT 400"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-31346.json",
          "summary": "CVE-2021-31346 Mitre 5.0 json"
        }
      ]
    },
    {
      "title": "CVE-2021-31889",
      "notes": [
        {
          "title": "Summary",
          "category": "summary",
          "text": "Malformed TCP packets with a corrupted SACK option leads to Information Leaks and Denial-of-Service conditions. (FSMD-2021-0015)"
        }
      ],
      "cve": "CVE-2021-31889",
      "cwe": {
        "id": "CWE-191",
        "name": "Integer Underflow (Wrap or Wraparound)"
      },
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "scores": [
        {
          "cvss_v3": {
            "version": "3.1",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C"
          },
          "products": [
            "1"
          ]
        }
      ],
      "remediations": [
        {
          "product_ids": [
            "1"
          ],
          "category": "vendor_fix",
          "details": "Update to V0.5.0.0 or later version",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109778383/"
        }
      ],
      "references": [
        {
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109778383/",
          "summary": "CVE-2021-31889 - SIMOTICS CONNECT 400"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-31889.json",
          "summary": "CVE-2021-31889 Mitre 5.0 json"
        }
      ]
    },
    {
      "title": "CVE-2021-31890",
      "notes": [
        {
          "title": "Summary",
          "category": "summary",
          "text": "The total length of an TCP payload (set in the IP header) is unchecked. This may lead to various side effects, including Information Leak and Denial-of-Service conditions, depending on the network buffer organization in memory. (FSMD-2021-0017)"
        }
      ],
      "cve": "CVE-2021-31890",
      "cwe": {
        "id": "CWE-240",
        "name": "Improper Handling of Inconsistent Structural Elements"
      },
      "product_status": {
        "known_affected": [
          "1",
          "2"
        ]
      },
      "scores": [
        {
          "cvss_v3": {
            "version": "3.1",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C"
          },
          "products": [
            "1",
            "2"
          ]
        }
      ],
      "remediations": [
        {
          "product_ids": [
            "1"
          ],
          "category": "vendor_fix",
          "details": "Update to V0.5.0.0 or later version",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109778383/"
        },
        {
          "product_ids": [
            "2"
          ],
          "category": "vendor_fix",
          "details": "Update to V1.0.0.0 or later version",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109778383/"
        }
      ],
      "references": [
        {
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109778383/",
          "summary": "CVE-2021-31890 - SIMOTICS CONNECT 400"
        },
        {
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109778383/",
          "summary": "CVE-2021-31890 - SIMOTICS CONNECT 400"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-31890.json",
          "summary": "CVE-2021-31890 Mitre 5.0 json"
        }
      ]
    }
  ]
}