CVE-2021-31886

CVE Enrichment

CVSS: 9.8 CRITICAL
EPSS: 3.05%
EPSS Percentile: 87.46%
CISA KEV: Not listed

Description

A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.4), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.19), APOGEE PXC Modular (BACnet) (All versions < V3.5.4), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.19), Desigo PXC00-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC00-U (All versions >= V2.3 and < V6.30.016), Desigo PXC001-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC100-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC12-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC128-U (All versions >= V2.3 and < V6.30.016), Desigo PXC200-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC22-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC22.1-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC36.1-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC50-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC64-U (All versions >= V2.3 and < V6.30.016), Desigo PXM20-E (All versions >= V2.3 and < V6.30.016), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.4), Nucleus Source Code (All versions), TALON TC Compact (BACnet) (All versions < V3.5.4), TALON TC Modular (BACnet) (All versions < V3.5.4). FTP server does not properly validate the length of the “USER” command, leading to stack-based buffer overflows. This may result in Denial-of-Service conditions and Remote Code Execution. (FSMD-2021-0010)

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 09-Nov-2021 19:15
Last Modified: 17-Jun-2026 10:52
EPSS Date: 2026-10-22
CWE: CWE-170, CWE-787

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

Affected Products / Versions

siemens / nucleus_net Source: NVD CPE · affected
Version / affected range: *
cpe:2.3:a:siemens:nucleus_net:*:*:*:*:*:*:*:*
siemens / nucleus_readystart_v3 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 2017.02.4
cpe:2.3:a:siemens:nucleus_readystart_v3:*:*:*:*:*:*:*:*
siemens / nucleus_source_code Source: NVD CPE · affected
Version / affected range: *
cpe:2.3:a:siemens:nucleus_source_code:*:*:*:*:*:*:*:*
siemens / apogee_modular_building_controller_firmware Source: NVD CPE · affected
Version / affected range: *
cpe:2.3:o:siemens:apogee_modular_building_controller_firmware:*:*:*:*:*:*:*:*
siemens / apogee_modular_equiment_controller_firmware Source: NVD CPE · affected
Version / affected range: *
cpe:2.3:o:siemens:apogee_modular_equiment_controller_firmware:*:*:*:*:*:*:*:*
siemens / apogee_pxc_compact_firmware Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 2.8.19
cpe:2.3:o:siemens:apogee_pxc_compact_firmware:*:*:*:*:p2_ethernet:*:*:*
siemens / apogee_pxc_compact_firmware Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 3.5.4
cpe:2.3:o:siemens:apogee_pxc_compact_firmware:*:*:*:*:bacnet:*:*:*
siemens / apogee_pxc_modular_firmware Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 2.8.19
cpe:2.3:o:siemens:apogee_pxc_modular_firmware:*:*:*:*:p2_ethernet:*:*:*
siemens / apogee_pxc_modular_firmware Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 3.5.4
cpe:2.3:o:siemens:apogee_pxc_modular_firmware:*:*:*:*:bacnet:*:*:*
siemens / talon_tc_compact_firmware Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 3.5.4
cpe:2.3:o:siemens:talon_tc_compact_firmware:*:*:*:*:*:*:*:*
siemens / talon_tc_modular_firmware Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 3.5.4
cpe:2.3:o:siemens:talon_tc_modular_firmware:*:*:*:*:*:*:*:*
siemens / desigo_pxc00-e.d_firmware Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 2.3 · before (exclusive) 6.30.016
cpe:2.3:o:siemens:desigo_pxc00-e.d_firmware:*:*:*:*:*:*:*:*
siemens / desigo_pxc00-u_firmware Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 2.3 · before (exclusive) 6.30.016
cpe:2.3:o:siemens:desigo_pxc00-u_firmware:*:*:*:*:*:*:*:*
siemens / desigo_pxc001-e.d_firmware Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 2.3 · before (exclusive) 6.30.016
cpe:2.3:o:siemens:desigo_pxc001-e.d_firmware:*:*:*:*:*:*:*:*
siemens / desigo_pxc12-e.d_firmware Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 2.3 · before (exclusive) 6.30.016
cpe:2.3:o:siemens:desigo_pxc12-e.d_firmware:*:*:*:*:*:*:*:*
siemens / desigo_pxc22-e.d_firmware Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 2.3 · before (exclusive) 6.30.016
cpe:2.3:o:siemens:desigo_pxc22-e.d_firmware:*:*:*:*:*:*:*:*
siemens / desigo_pxc22.1-e.d_firmware Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 2.3 · before (exclusive) 6.30.016
cpe:2.3:o:siemens:desigo_pxc22.1-e.d_firmware:*:*:*:*:*:*:*:*
siemens / desigo_pxc36.1-e.d_firmware Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 2.3 · before (exclusive) 6.30.016
cpe:2.3:o:siemens:desigo_pxc36.1-e.d_firmware:*:*:*:*:*:*:*:*
siemens / desigo_pxc50-e.d_firmware Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 2.3 · before (exclusive) 6.30.016
cpe:2.3:o:siemens:desigo_pxc50-e.d_firmware:*:*:*:*:*:*:*:*
siemens / desigo_pxc64-u_firmware Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 2.3 · before (exclusive) 6.30.016
cpe:2.3:o:siemens:desigo_pxc64-u_firmware:*:*:*:*:*:*:*:*
siemens / desigo_pxc100-e.d_firmware Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 2.3 · before (exclusive) 6.30.016
cpe:2.3:o:siemens:desigo_pxc100-e.d_firmware:*:*:*:*:*:*:*:*
siemens / desigo_pxc128-u_firmware Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 2.3 · before (exclusive) 6.30.016
cpe:2.3:o:siemens:desigo_pxc128-u_firmware:*:*:*:*:*:*:*:*
siemens / desigo_pxc200-e.d_firmware Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 2.3 · before (exclusive) 6.30.016
cpe:2.3:o:siemens:desigo_pxc200-e.d_firmware:*:*:*:*:*:*:*:*
siemens / desigo_pxm20-e_firmware Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 2.3 · before (exclusive) 6.30.016
cpe:2.3:o:siemens:desigo_pxm20-e_firmware:*:*:*:*:*:*:*:*

References

Last enrichment sync: 02-Nov-2026 06:34
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

The starting point was a previously developed exploit for the WAGO 750-852 PLC, based on CVE-2021-31886, a pre-authentication buffer overflow in the Nucleus FTP server that allows an unauthenticated attacker to execute Forescout Uses Claude to Port WAGO PLC Exploit, Bricking Device in C2 Test

MITRE ATT&CK (1)

Vendors (2)

Products (4)

Tools (2)

Industries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.