CVE-2021-25677 — Siemens / APOGEE PXC Compact (BACnet)

Description (CNA)

A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (All versions < V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.20), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.3), Nucleus ReadyStart V3 (All versions < V2017.02.4), Nucleus ReadyStart V4 (All versions < V4.1.0), Nucleus Source Code (Versions including affected DNS modules), SIMOTICS CONNECT 400 (All versions < V0.5.0.0), SIMOTICS CONNECT 400 (All versions >= V0.5.0.0 < V1.0.0.0), TALON TC Compact (BACnet) (All versions < V3.5.5), TALON TC Modular (BACnet) (All versions < V3.5.5). The DNS client does not properly randomize DNS transaction IDs. That could allow an attacker to poison the DNS cache or spoof DNS resolving.

Affected (CNA)

Vendor / product	Versions
Siemens / APOGEE PXC Compact (BACnet)	affected All versions < V3.5.5
Siemens / APOGEE PXC Compact (P2 Ethernet)	affected All versions < V2.8.20
Siemens / APOGEE PXC Modular (BACnet)	affected All versions < V3.5.5
Siemens / APOGEE PXC Modular (P2 Ethernet)	affected All versions < V2.8.20
Siemens / Nucleus NET	affected All versions
Siemens / Nucleus ReadyStart V3	affected All versions < V2017.02.3
Siemens / Nucleus ReadyStart V3	affected All versions < V2017.02.4
Siemens / Nucleus ReadyStart V4	affected All versions < V4.1.0
Siemens / Nucleus Source Code	affected Versions including affected DNS modules
Siemens / SIMOTICS CONNECT 400	affected All versions < V0.5.0.0
Siemens / SIMOTICS CONNECT 400	affected All versions >= V0.5.0.0 < V1.0.0.0
Siemens / TALON TC Compact (BACnet)	affected All versions < V3.5.5
Siemens / TALON TC Modular (BACnet)	affected All versions < V3.5.5

CWE

CWE-330

References

ADP enrichment

CVE

No English description supplied.