CVE-2021-25676 - OpenCVE

A vulnerability has been identified in RUGGEDCOM RM1224 (V6.3), SCALANCE M-800 (V6.3), SCALANCE S615 (V6.3), SCALANCE SC-600 (All Versions >= V2.1 and < V2.1.3). Multiple failed SSH authentication attempts could trigger a temporary Denial-of-Service under certain conditions. When triggered, the device will reboot automatically.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

AV:N/AC:L/Au:N/C:N/I:N/A:P

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Siemens	Ruggedcom Rm1224 Ruggedcom Rm1224 Firmware Scalance M-800 Scalance M-800 Firmware Scalance S615 Scalance S615 Firmware Scalance Sc-600 Scalance Sc-600 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:siemens:ruggedcom_rm1224_firmware:6.3:*:*:*:*:*:*:*

cpe:2.3:h:siemens:ruggedcom_rm1224:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:siemens:scalance_m-800_firmware:6.3:*:*:*:*:*:*:*

cpe:2.3:h:siemens:scalance_m-800:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:siemens:scalance_s615_firmware:6.3:*:*:*:*:*:*:*

cpe:2.3:h:siemens:scalance_s615:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:siemens:scalance_sc-600_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:siemens:scalance_sc-600:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://cert-portal.siemens.com/productcert/pdf/ssa-296266.pdf
https://us-cert.cisa.gov/ics/advisories/icsa-21-068-02

History

No history.

MITRE

Status: PUBLISHED

Assigner: siemens

Published: 2021-03-15T17:03:31

Updated: 2024-08-03T20:11:27.563Z

Reserved: 2021-01-21T00:00:00

Link: CVE-2021-25676

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2021-03-15T17:15:22.127

Modified: 2021-04-20T17:41:15.860

Link: CVE-2021-25676

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "RUGGEDCOM RM1224", "vendor": "Siemens", "versions": [{"status": "affected", "version": "V6.3"}]}, {"product": "SCALANCE M-800", "vendor": "Siemens", "versions": [{"status": "affected", "version": "V6.3"}]}, {"product": "SCALANCE S615", "vendor": "Siemens", "versions": [{"status": "affected", "version": "V6.3"}]}, {"product": "SCALANCE SC-600", "vendor": "Siemens", "versions": [{"status": "affected", "version": "All Versions >= V2.1 and < V2.1.3"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in RUGGEDCOM RM1224 (V6.3), SCALANCE M-800 (V6.3), SCALANCE S615 (V6.3), SCALANCE SC-600 (All Versions >= V2.1 and < V2.1.3). Multiple failed SSH authentication attempts could trigger a temporary Denial-of-Service under certain conditions. When triggered, the device will reboot automatically."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-307", "description": "CWE-307: Improper Restriction of Excessive Authentication Attempts", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-04-22T20:42:21", "orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "shortName": "siemens"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-296266.pdf"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-068-02"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "productcert@siemens.com", "ID": "CVE-2021-25676", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "RUGGEDCOM RM1224", "version": {"version_data": [{"version_value": "V6.3"}]}}, {"product_name": "SCALANCE M-800", "version": {"version_data": [{"version_value": "V6.3"}]}}, {"product_name": "SCALANCE S615", "version": {"version_data": [{"version_value": "V6.3"}]}}, {"product_name": "SCALANCE SC-600", "version": {"version_data": [{"version_value": "All Versions >= V2.1 and < V2.1.3"}]}}]}, "vendor_name": "Siemens"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A vulnerability has been identified in RUGGEDCOM RM1224 (V6.3), SCALANCE M-800 (V6.3), SCALANCE S615 (V6.3), SCALANCE SC-600 (All Versions >= V2.1 and < V2.1.3). Multiple failed SSH authentication attempts could trigger a temporary Denial-of-Service under certain conditions. When triggered, the device will reboot automatically."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-307: Improper Restriction of Excessive Authentication Attempts"}]}]}, "references": {"reference_data": [{"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-296266.pdf", "refsource": "MISC", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-296266.pdf"}, {"name": "https://us-cert.cisa.gov/ics/advisories/icsa-21-068-02", "refsource": "CONFIRM", "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-068-02"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T20:11:27.563Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-296266.pdf"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-068-02"}]}]}, "cveMetadata": {"assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "assignerShortName": "siemens", "cveId": "CVE-2021-25676", "datePublished": "2021-03-15T17:03:31", "dateReserved": "2021-01-21T00:00:00", "dateUpdated": "2024-08-03T20:11:27.563Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:siemens:ruggedcom_rm1224_firmware:6.3:*:*:*:*:*:*:*", "matchCriteriaId": "041588BC-B3E6-400F-AF25-869D38EE3A1D", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:siemens:ruggedcom_rm1224:-:*:*:*:*:*:*:*", "matchCriteriaId": "284DF779-D900-48B4-A177-7281CD445AB5", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:siemens:scalance_m-800_firmware:6.3:*:*:*:*:*:*:*", "matchCriteriaId": "57AE2532-01C4-4E62-836B-48FA7B0D932A", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:siemens:scalance_m-800:-:*:*:*:*:*:*:*", "matchCriteriaId": "DFB9921A-5204-40A3-88AB-B7755F5C6875", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:siemens:scalance_s615_firmware:6.3:*:*:*:*:*:*:*", "matchCriteriaId": "A2B9767D-9249-4524-BA86-484610EDF9D1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:siemens:scalance_s615:-:*:*:*:*:*:*:*", "matchCriteriaId": "E917CBBB-EF41-4113-B0CA-EB91889235E7", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:siemens:scalance_sc-600_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "FABE752D-A89A-4C2A-980E-AC75E471BA51", "versionEndExcluding": "2.1.3", "versionStartIncluding": "2.1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:siemens:scalance_sc-600:-:*:*:*:*:*:*:*", "matchCriteriaId": "725C671B-D7A0-48CF-8A31-5F9C4173F1DD", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in RUGGEDCOM RM1224 (V6.3), SCALANCE M-800 (V6.3), SCALANCE S615 (V6.3), SCALANCE SC-600 (All Versions >= V2.1 and < V2.1.3). Multiple failed SSH authentication attempts could trigger a temporary Denial-of-Service under certain conditions. When triggered, the device will reboot automatically."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad en RUGGEDCOM RM1224 (versi\u00f3n V6.3), SCALANCE M-800 (versi\u00f3n V6.3), SCALANCE S615 (versi\u00f3n V6.3), SCALANCE SC-600 (Todas las versiones posteriores a V2.1 y anteriores a V2.1.3) . M\u00faltiples intentos fallidos de autenticaci\u00f3n SSH podr\u00edan desencadenar una Denegaci\u00f3n de Servicio temporal en determinadas condiciones. Cuando es desencadenada, el dispositivo se reiniciar\u00e1 autom\u00e1ticamente"}], "id": "CVE-2021-25676", "lastModified": "2021-04-20T17:41:15.860", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-03-15T17:15:22.127", "references": [{"source": "productcert@siemens.com", "tags": ["Vendor Advisory"], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-296266.pdf"}, {"source": "productcert@siemens.com", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-068-02"}], "sourceIdentifier": "productcert@siemens.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-307"}], "source": "productcert@siemens.com", "type": "Primary"}]}