CVE-2021-25677

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (All versions < V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.20), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.3), Nucleus ReadyStart V3 (All versions < V2017.02.4), Nucleus ReadyStart V4 (All versions < V4.1.0), Nucleus Source Code (Versions including affected DNS modules), SIMOTICS CONNECT 400 (All versions < V0.5.0.0), SIMOTICS CONNECT 400 (All versions >= V0.5.0.0 < V1.0.0.0), TALON TC Compact (BACnet) (All versions < V3.5.5), TALON TC Modular (BACnet) (All versions < V3.5.5). The DNS client does not properly randomize DNS transaction IDs. That could allow an attacker to poison the DNS cache or spoof DNS resolving.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-330

Affected software

VendorProductVersions
SiemensAPOGEE PXC Compact (BACnet)All versions < V3.5.5
SiemensAPOGEE PXC Compact (P2 Ethernet)All versions < V2.8.20
SiemensAPOGEE PXC Modular (BACnet)All versions < V3.5.5
SiemensAPOGEE PXC Modular (P2 Ethernet)All versions < V2.8.20
SiemensNucleus NETAll versions
SiemensNucleus ReadyStart V3All versions < V2017.02.3
SiemensNucleus ReadyStart V3All versions < V2017.02.4
SiemensNucleus ReadyStart V4All versions < V4.1.0
SiemensNucleus Source CodeVersions including affected DNS modules
SiemensSIMOTICS CONNECT 400All versions < V0.5.0.0
SiemensSIMOTICS CONNECT 400All versions >= V0.5.0.0 < V1.0.0.0
SiemensTALON TC Compact (BACnet)All versions < V3.5.5
SiemensTALON TC Modular (BACnet)All versions < V3.5.5

References

Timeline

Published
Apr 22, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-256787.8A vulnerability has been identified in Solid Edge SE2020 (All versions < SE2020MP13), Solid Edge SE2020 (All versions < SE2020MP14), Solid ECVE-2021-256795.4The AdTran Personal Phone Manager software is vulnerable to an authenticated stored cross-site scripting (XSS) issues. These issues impact aCVE-2021-256806.1The AdTran Personal Phone Manager software is vulnerable to multiple reflected cross-site scripting (XSS) issues. These issues impact at minCVE-2021-256817.5AdTran Personal Phone Manager 10.8.1 software is vulnerable to an issue that allows for exfiltration of data over DNS. This could allow for CVE-2021-256827.8It was discovered that the get_pid_info() function in data/apport did not properly parse the /proc/pid/status file from the kernel.CVE-2021-256837.8It was discovered that the get_starttime() function in data/apport did not properly parse the /proc/pid/stat file from the kernel.CVE-2021-256847.8It was discovered that apport in data/apport did not properly open a report file to prevent hanging reads on a FIFO.CVE-2021-256885.5Under certain conditions, Teradici PCoIP Agents for Windows prior to version 20.10.0 and Teradici PCoIP Agents for Linux prior to version 21CVE-2021-256899.8An out of bounds write in Teradici PCoIP soft client versions prior to version 20.10.1 could allow an attacker to remotely execute code.CVE-2021-256907.5A null pointer dereference in Teradici PCoIP Soft Client versions prior to 20.07.3 could allow an attacker to crash the software.CVE-2021-256924.6Sensitive smart card data is logged in default INFO logs by Teradici's PCoIP Connection Manager and Security Gateway prior to version 21.01.CVE-2021-256937.5An attacker may cause a Denial of Service (DoS) in multiple versions of Teradici PCoIP Agent via a null pointer dereference.
CVE-2021-25677: Medium severity, CVSS 5.3 | Vulnix