| Title | 複数のシーメンス製品における境界外読み取りに関する脆弱性 |
|---|---|
| Summary | 複数のシーメンス製品には、境界外読み取りに関する脆弱性、および境界外書き込みに関する脆弱性が存在します。 |
| Possible impacts | 情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。 |
| Solution | ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。 |
| Publication Date | Nov. 9, 2021, midnight |
| Registration Date | Dec. 17, 2021, 1:54 p.m. |
| Last Update | Dec. 17, 2021, 1:54 p.m. |
| CVSS3.0 : 緊急 | |
| Score | 9.8 |
|---|---|
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CVSS2.0 : 危険 | |
| Score | 7.5 |
|---|---|
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| シーメンス |
| APOGEE Modular Building Controller ファームウェア |
| APOGEE Modular Equiment Controller ファームウェア |
| APOGEE PXC Compact ファームウェア |
| APOGEE PXC Modular ファームウェア |
| Capital VSTAR |
| Nucleus NET |
| Nucleus ReadyStart V3 |
| Nucleus Source Code |
| TALON TC Compact ファームウェア |
| TALON TC Modular ファームウェア |
| No | Changed Details | Date of change |
|---|---|---|
| 1 | [2021年12月17日] 掲載 |
Dec. 17, 2021, 1:54 p.m. |
| Summary | A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.4), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.19), APOGEE PXC Modular (BACnet) (All versions < V3.5.4), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.19), Capital VSTAR (All versions with enabled Ethernet options), Desigo PXC00-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC00-U (All versions >= V2.3 and < V6.30.016), Desigo PXC001-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC100-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC12-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC128-U (All versions >= V2.3 and < V6.30.016), Desigo PXC200-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC22-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC22.1-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC36.1-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC50-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC64-U (All versions >= V2.3 and < V6.30.016), Desigo PXM20-E (All versions >= V2.3 and < V6.30.016), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.4), Nucleus Source Code (All versions), TALON TC Compact (BACnet) (All versions < V3.5.4), TALON TC Modular (BACnet) (All versions < V3.5.4). The DHCP client application assumes that the data supplied with the “Hostname” DHCP option is NULL terminated. In cases when global hostname variable is not defined, this may lead to Out-of-bound reads, writes, and Denial-of-service conditions. (FSMD-2021-0014) |
|---|---|
| Publication Date | Nov. 9, 2021, 9:15 p.m. |
| Registration Date | Nov. 10, 2021, 10 a.m. |
| Last Update | Nov. 21, 2024, 3:06 p.m. |
| Configuration1 | or higher | or less | more than | less than | |
| cpe:2.3:a:siemens:nucleus_source_code:*:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:siemens:nucleus_net:*:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:siemens:capital_vstar:-:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:siemens:nucleus_readystart_v3:*:*:*:*:*:*:*:* | 2017.02.1 | ||||
| Configuration2 | or higher | or less | more than | less than | |
| cpe:2.3:o:siemens:apogee_modular_building_controller_firmware:*:*:*:*:*:*:*:* | |||||
| execution environment | |||||
| 1 | cpe:2.3:h:siemens:apogee_modular_building_controller:-:*:*:*:*:*:*:* | ||||
| Configuration3 | or higher | or less | more than | less than | |
| cpe:2.3:o:siemens:apogee_modular_equiment_controller_firmware:*:*:*:*:*:*:*:* | |||||
| execution environment | |||||
| 1 | cpe:2.3:h:siemens:apogee_modular_equiment_controller:-:*:*:*:*:*:*:* | ||||
| Configuration4 | or higher | or less | more than | less than | |
| cpe:2.3:o:siemens:apogee_pxc_compact_firmware:*:*:*:*:*:*:*:* | 2.8.19 | ||||
| execution environment | |||||
| 1 | cpe:2.3:h:siemens:apogee_pxc_compact:-:*:*:*:*:*:*:* | ||||
| Configuration5 | or higher | or less | more than | less than | |
| cpe:2.3:o:siemens:apogee_pxc_modular_firmware:*:*:*:*:*:*:*:* | 2.8.19 | ||||
| execution environment | |||||
| 1 | cpe:2.3:h:siemens:apogee_pxc_modular:-:*:*:*:*:*:*:* | ||||
| Configuration6 | or higher | or less | more than | less than | |
| cpe:2.3:o:siemens:talon_tc_compact_firmware:*:*:*:*:*:*:*:* | 3.5.4 | ||||
| execution environment | |||||
| 1 | cpe:2.3:h:siemens:talon_tc_compact:-:*:*:*:*:*:*:* | ||||
| Configuration7 | or higher | or less | more than | less than | |
| cpe:2.3:o:siemens:talon_tc_modular_firmware:*:*:*:*:*:*:*:* | 3.5.4 | ||||
| execution environment | |||||
| 1 | cpe:2.3:h:siemens:talon_tc_modular:-:*:*:*:*:*:*:* | ||||
| Configuration8 | or higher | or less | more than | less than | |
| cpe:2.3:o:siemens:desigo_pxc00-e.d_firmware:*:*:*:*:*:*:*:* | 2.3 | 6.30.016 | |||
| execution environment | |||||
| 1 | cpe:2.3:h:siemens:desigo_pxc00-e.d:-:*:*:*:*:*:*:* | ||||
| Configuration9 | or higher | or less | more than | less than | |
| cpe:2.3:o:siemens:desigo_pxc00-u_firmware:*:*:*:*:*:*:*:* | 2.3 | 6.30.016 | |||
| execution environment | |||||
| 1 | cpe:2.3:h:siemens:desigo_pxc00-u:-:*:*:*:*:*:*:* | ||||
| Configuration10 | or higher | or less | more than | less than | |
| cpe:2.3:o:siemens:desigo_pxc001-e.d_firmware:*:*:*:*:*:*:*:* | 2.3 | 6.30.016 | |||
| execution environment | |||||
| 1 | cpe:2.3:h:siemens:desigo_pxc001-e.d:-:*:*:*:*:*:*:* | ||||
| Configuration11 | or higher | or less | more than | less than | |
| cpe:2.3:o:siemens:desigo_pxc12-e.d_firmware:*:*:*:*:*:*:*:* | 2.3 | 6.30.016 | |||
| execution environment | |||||
| 1 | cpe:2.3:h:siemens:desigo_pxc12-e.d:-:*:*:*:*:*:*:* | ||||
| Configuration12 | or higher | or less | more than | less than | |
| cpe:2.3:o:siemens:desigo_pxc22-e.d_firmware:*:*:*:*:*:*:*:* | 2.3 | 6.30.016 | |||
| execution environment | |||||
| 1 | cpe:2.3:h:siemens:desigo_pxc22-e.d:-:*:*:*:*:*:*:* | ||||
| Configuration13 | or higher | or less | more than | less than | |
| cpe:2.3:o:siemens:desigo_pxc22.1-e.d_firmware:*:*:*:*:*:*:*:* | 2.3 | 6.30.016 | |||
| execution environment | |||||
| 1 | cpe:2.3:h:siemens:desigo_pxc22.1-e.d:-:*:*:*:*:*:*:* | ||||
| Configuration14 | or higher | or less | more than | less than | |
| cpe:2.3:o:siemens:desigo_pxc36.1-e.d_firmware:*:*:*:*:*:*:*:* | 2.3 | 6.30.016 | |||
| execution environment | |||||
| 1 | cpe:2.3:h:siemens:desigo_pxc36.1-e.d:-:*:*:*:*:*:*:* | ||||
| Configuration15 | or higher | or less | more than | less than | |
| cpe:2.3:o:siemens:desigo_pxc50-e.d_firmware:*:*:*:*:*:*:*:* | 2.3 | 6.30.016 | |||
| execution environment | |||||
| 1 | cpe:2.3:h:siemens:desigo_pxc50-e.d:-:*:*:*:*:*:*:* | ||||
| Configuration16 | or higher | or less | more than | less than | |
| cpe:2.3:o:siemens:desigo_pxc64-u_firmware:*:*:*:*:*:*:*:* | 2.3 | 6.30.016 | |||
| execution environment | |||||
| 1 | cpe:2.3:h:siemens:desigo_pxc64-u:-:*:*:*:*:*:*:* | ||||
| Configuration17 | or higher | or less | more than | less than | |
| cpe:2.3:o:siemens:desigo_pxc100-e.d_firmware:*:*:*:*:*:*:*:* | 2.3 | 6.30.016 | |||
| execution environment | |||||
| 1 | cpe:2.3:h:siemens:desigo_pxc100-e.d:-:*:*:*:*:*:*:* | ||||
| Configuration18 | or higher | or less | more than | less than | |
| cpe:2.3:o:siemens:desigo_pxc128-u_firmware:*:*:*:*:*:*:*:* | 2.3 | 6.30.016 | |||
| execution environment | |||||
| 1 | cpe:2.3:h:siemens:desigo_pxc128-u:-:*:*:*:*:*:*:* | ||||
| Configuration19 | or higher | or less | more than | less than | |
| cpe:2.3:o:siemens:desigo_pxc200-e.d_firmware:*:*:*:*:*:*:*:* | 2.3 | 6.30.016 | |||
| execution environment | |||||
| 1 | cpe:2.3:h:siemens:desigo_pxc200-e.d:-:*:*:*:*:*:*:* | ||||
| Configuration20 | or higher | or less | more than | less than | |
| cpe:2.3:o:siemens:desigo_pxm20-e_firmware:*:*:*:*:*:*:*:* | 2.3 | 6.30.016 | |||
| execution environment | |||||
| 1 | cpe:2.3:h:siemens:desigo_pxm20-e:-:*:*:*:*:*:*:* | ||||
| Configuration21 | or higher | or less | more than | less than | |
| cpe:2.3:o:siemens:apogee_pxc_compact_firmware:*:*:*:*:*:*:*:* | 3.5.4 | ||||
| execution environment | |||||
| 1 | cpe:2.3:h:siemens:apogee_pxc_compact:-:*:*:*:*:*:*:* | ||||
| Configuration22 | or higher | or less | more than | less than | |
| cpe:2.3:o:siemens:apogee_pxc_modular_firmware:*:*:*:*:*:*:*:* | 3.5.4 | ||||
| execution environment | |||||
| 1 | cpe:2.3:h:siemens:apogee_pxc_modular:-:*:*:*:*:*:*:* | ||||