{"id":"CVE-2021-31883","aliases":["EUVD-2021-18758","GHSA-9p2c-f575-r7xw"],"status":"published","title":"A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC)...","description":"A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions \u003c V2303). When processing a DHCP ACK message, the DHCP client application does not validate the length of the Vendor option(s), leading to Denial-of-Service conditions. (FSMD-2021-0013)","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.01526,"percentile":0.75046,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-119"],"published":"2021-11-09T11:31:56Z","modified":"2026-06-17T03:52:24Z","products":[{"vendor":"siemens","product":"apogee_modular_building_controller_firmware"},{"vendor":"siemens","product":"apogee_modular_equiment_controller_firmware"},{"vendor":"siemens","product":"apogee_pxc_compact_firmware"},{"vendor":"siemens","product":"apogee_pxc_modular_firmware"},{"vendor":"siemens","product":"capital embedded ar classic 431-422"},{"vendor":"siemens","product":"capital embedded ar classic r20-11"},{"vendor":"siemens","product":"capital_vstar"},{"vendor":"siemens","product":"nucleus_net"},{"vendor":"siemens","product":"nucleus_readystart_v3"},{"vendor":"siemens","product":"nucleus_source_code"},{"vendor":"siemens","product":"talon_tc_compact_firmware"},{"vendor":"siemens","product":"talon_tc_modular_firmware"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-114589.pdf","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-044112.pdf","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-620288.pdf","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-114589.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-044112.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-620288.html"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-31883"},{"url":"https://github.com/advisories/GHSA-9p2c-f575-r7xw"}],"sources":{"cve":[{"id":"CVE-2021-31883","description":"A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions \u003c V2303). When processing a DHCP ACK message, the DHCP client application does not validate the length of the Vendor option(s), leading to Denial-of-Service conditions. (FSMD-2021-0013)","status":"published","published":"2021-11-09T11:31:56Z","modified":"2025-03-11T09:47:43.75Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:33:05.331617Z"}],"euvd":[{"id":"EUVD-2021-18758","description":"A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions \u003c V2303). When processing a DHCP ACK message, the DHCP client application does not validate the length of the Vendor option(s), leading to Denial-of-Service conditions. (FSMD-2021-0013)","status":"published","published":"2021-11-09T11:31:56Z","modified":"2025-03-11T09:47:43Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T20:53:08.182954Z"}],"ghsa":[{"id":"GHSA-9p2c-f575-r7xw","title":"A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC)...","description":"A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions), APOGEE PXC Compact (P2 Ethernet) (All versions), APOGEE PXC Modular (BACnet) (All versions), APOGEE PXC Modular (P2 Ethernet) (All versions), Capital VSTAR (All versions), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions \u003c V2017.02.4), Nucleus Source Code (All versions), TALON TC Compact (BACnet) (All versions), TALON TC Modular (BACnet) (All versions). When processing a DHCP ACK message, the DHCP client application does not validate the length of the Vendor option(s), leading to Denial-of-Service conditions. (FSMD-2021-0013)","status":"published","published":"2022-05-24T19:20:11Z","modified":"2024-10-08T09:30:51Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:58:26.306971Z"}],"nvd":[{"id":"CVE-2021-31883","description":"A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions \u003c V2303). When processing a DHCP ACK message, the DHCP client application does not validate the length of the Vendor option(s), leading to Denial-of-Service conditions. (FSMD-2021-0013)","status":"published","published":"2021-11-09T12:15:09.383Z","modified":"2026-06-17T03:52:24.653Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:07:00.984108Z"}]}}