CVE-2021-31889

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), PLUSCONTROL 1st Gen (All versions), SIMOTICS CONNECT 400 (All versions < V0.5.0.0). Malformed TCP packets with a corrupted SACK option leads to Information Leaks and Denial-of-Service conditions. (FSMD-2021-0015)

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-191

Affected software

Vendor	Product	Versions
Siemens	Capital Embedded AR Classic 431-422	< *
Siemens	Capital Embedded AR Classic R20-11	< V2303
Siemens	PLUSCONTROL 1st Gen	All versions
Siemens	SIMOTICS CONNECT 400	All versions < V0.5.0.0

References

Timeline

Published: Nov 9, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-31896.1The slashify package 1.0.0 for Node.js allows open-redirect attacks, as demonstrated by a localhost:3000///example.com/ substring.CVE-2021-318909.1A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions CVE-2021-3189110.0A vulnerability has been identified in Desigo CC (All versions with OIS Extension Module), GMA-Manager (All versions with OIS running on Deb CVE-2021-318927.4A vulnerability has been identified in SINUMERIK Analyse MyCondition (All versions), SINUMERIK Analyze MyPerformance (All versions), SINUMER CVE-2021-318937.8A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3), SIMATIC CVE-2021-318948.8A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.X (All versions < V9.1 SP2), SIMATIC CVE-2021-318958.1A vulnerability has been identified in RUGGEDCOM i800 (All versions < V4.3.7), RUGGEDCOM i801 (All versions < V4.3.7), RUGGEDCOM i802 (All v CVE-2021-318979.8In JetBrains WebStorm before 2021.1, code execution without user confirmation was possible for untrusted projects.CVE-2021-318987.5In JetBrains WebStorm before 2021.1, HTTP requests were used instead of HTTPS.CVE-2021-318998.8In JetBrains Code With Me bundled to the compatible IDEs before version 2021.1, the client could execute code in read-only mode.CVE-2021-31909.8The async-git package before 1.13.2 for Node.js allows OS Command Injection via shell metacharacters, as demonstrated by git.reset and git.t CVE-2021-319005.3In JetBrains Code With Me bundled to the compatible IDE versions before 2021.1, a client could open a browser on a host.