CVE-2021-25676

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in RUGGEDCOM RM1224 (V6.3), SCALANCE M-800 (V6.3), SCALANCE S615 (V6.3), SCALANCE SC-600 (All Versions >= V2.1 and < V2.1.3). Multiple failed SSH authentication attempts could trigger a temporary Denial-of-Service under certain conditions. When triggered, the device will reboot automatically.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-307

Affected software

Vendor	Product	Versions
Siemens	RUGGEDCOM RM1224	V6.3
Siemens	SCALANCE M-800	V6.3
Siemens	SCALANCE S615	V6.3
Siemens	SCALANCE SC-600	All Versions >= V2.1 and < V2.1.3

References

https://cert-portal.siemens.com/productcert/pdf/ssa-296266.pdfVendor Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-21-068-02Third Party Advisory, US Government Resource
https://cert-portal.siemens.com/productcert/pdf/ssa-296266.pdfVendor Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-21-068-02Third Party Advisory, US Government Resource

Timeline

Published: Mar 15, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-256775.3A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions <CVE-2021-256787.8A vulnerability has been identified in Solid Edge SE2020 (All versions < SE2020MP13), Solid Edge SE2020 (All versions < SE2020MP14), Solid E CVE-2021-256795.4The AdTran Personal Phone Manager software is vulnerable to an authenticated stored cross-site scripting (XSS) issues. These issues impact a CVE-2021-256806.1The AdTran Personal Phone Manager software is vulnerable to multiple reflected cross-site scripting (XSS) issues. These issues impact at min CVE-2021-256817.5AdTran Personal Phone Manager 10.8.1 software is vulnerable to an issue that allows for exfiltration of data over DNS. This could allow for CVE-2021-256827.8It was discovered that the get_pid_info() function in data/apport did not properly parse the /proc/pid/status file from the kernel.CVE-2021-256837.8It was discovered that the get_starttime() function in data/apport did not properly parse the /proc/pid/stat file from the kernel.CVE-2021-256847.8It was discovered that apport in data/apport did not properly open a report file to prevent hanging reads on a FIFO.CVE-2021-256885.5Under certain conditions, Teradici PCoIP Agents for Windows prior to version 20.10.0 and Teradici PCoIP Agents for Linux prior to version 21 CVE-2021-256899.8An out of bounds write in Teradici PCoIP soft client versions prior to version 20.10.1 could allow an attacker to remotely execute code.CVE-2021-256907.5A null pointer dereference in Teradici PCoIP Soft Client versions prior to 20.07.3 could allow an attacker to crash the software.CVE-2021-256924.6Sensitive smart card data is logged in default INFO logs by Teradici's PCoIP Connection Manager and Security Gateway prior to version 21.01.