nvd-json-data-feeds/CVE-2021/CVE-2021-256xx/CVE-2021-25663.json

{
  "id": "CVE-2021-25663",
  "sourceIdentifier": "productcert@siemens.com",
  "published": "2021-04-22T21:15:09.957",
  "lastModified": "2021-12-10T19:55:42.500",
  "vulnStatus": "Analyzed",
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability has been identified in Capital VSTAR (Versions including affected IPv6 stack), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.4), Nucleus ReadyStart V4 (All versions < V4.1.0), Nucleus Source Code (Versions including affected IPv6 stack). The function that processes IPv6 headers does not check the lengths of extension header options, allowing attackers to put this function into an infinite loop with crafted length values."
    },
    {
      "lang": "es",
      "value": "Se ha identificado una vulnerabilidad en Capital VSTAR (Versiones que incluyen la pila IPv6 afectada), Nucleus NET (Todas las versiones), Nucleus ReadyStart V3 (Todas las versiones anteriores a V2017.02.4), Nucleus ReadyStart V4 (Todas las versiones anteriores a V4.1.0), Nucleus Source Code (Versiones que incluyen la pila IPv6 afectada). La funci\u00f3n que procesa las cabeceras de IPv6 no comprueba las longitudes de las opciones de las cabeceras de extensi\u00f3n, lo que permite a los atacantes poner esta funci\u00f3n en un bucle infinito con valores de longitud manipulados"
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "accessVector": "NETWORK",
          "accessComplexity": "LOW",
          "authentication": "NONE",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 5.0
        },
        "baseSeverity": "MEDIUM",
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-835"
        }
      ]
    },
    {
      "source": "productcert@siemens.com",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-835"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:siemens:capital_vstar:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "EEBF34F7-F37A-4FD1-957E-B2E5DEE7A778"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:siemens:nucleus_net:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "7A987CFB-4A41-4F82-8C7F-31DE8F0650DE"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:siemens:nucleus_readystart:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "4.1.0",
              "matchCriteriaId": "7A5FA7B8-2F94-4762-ADBF-71C0F37231AB"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:siemens:nucleus_source_code:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "53A38C64-612A-4BC5-83D5-D3FA1C90E0F7"
            }
          ]
        }
      ]
    },
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:siemens:nucleus_readystart:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "2017.02.4",
              "matchCriteriaId": "F768DEFE-CE6F-4210-B728-9C4CA2AF03FE"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-248289.pdf",
      "source": "productcert@siemens.com",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-103-05",
      "source": "productcert@siemens.com",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ]
    }
  ]
}