Full Report
Multiple vulnerabilities (also known as “NUCLEUS:13”) have been identified in the Nucleus RTOS (real-time operating system) and reported in the Siemens Security Advisory SSA-044112: https://cert-portal.siemens.com/productcert/pdf/ssa-044112.pdf. The products listed below use affected versions of the Nucleus software and inherently contain these vulnerabilities. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available.
Analysis Summary
# Vulnerability: NUCLEUS:13 (Multiple Vulnerabilities in Nucleus RTOS)
## CVE Details
The NUCLEUS:13 collection consists of 13 vulnerabilities. The most critical include:
- **CVE-2021-31886**: CVSS 9.8 (Critical) | CWE-120 (Buffer Copy without Checking Size of Input)
- **CVE-2021-31887**: CVSS 9.8 (Critical) | CWE-190 (Integer Overflow or Wraparound)
- **CVE-2021-31888**: CVSS 8.8 (High) | CWE-120
- **CVE-2021-31881**: CVSS 8.2 (High) | CWE-400 (Uncontrolled Resource Consumption)
- *(Note: Total of 13 CVEs ranging from CVSS 5.3 to 9.8)*
## Affected Systems
- **Products**: Nucleus RTOS, Nucleus NET, Nucleus ReadyStart, and various Siemens industrial/medical products (e.g., Capital VSTAR, SIMOTICS, SIMATIC, SINAMICS, and various Medical Imaging devices).
- **Versions**:
- Nucleus NET: All versions.
- Nucleus RTOS: Versions prior to v2021.05.
- Nucleus ReadyStart: Versions prior to v2021.05.
- **Configurations**: Systems using the affected TCP/IP stack (Nucleus NET) for network communications.
## Vulnerability Description
NUCLEUS:13 is a set of flaws residing in the TCP/IP stack of the Nucleus Real-Time Operating System. The vulnerabilities include memory corruption issues (buffer overflows, integer overflows) and denial-of-service flaws. Specifically, flaws in the handling of FTP, TFTP, and DHCP protocols allow for improper memory writes when processing specially crafted network packets.
## Exploitation
- **Status**: PoC available (demonstrated by researchers); no confirmed widespread exploitation in the wild at time of reporting.
- **Complexity**: Low to Medium.
- **Attack Vector**: Network (Remote).
## Impact
- **Confidentiality**: High (Data leakage via memory corruption).
- **Integrity**: High (Potential for Remote Code Execution (RCE)).
- **Availability**: High (Device crashes and Denial-of-Service (DoS)).
## Remediation
### Patches
- **Nucleus ReadyStart V4**: Update to v4.1.1 or later.
- **Nucleus ReadyStart V3**: Update to v2017.02.4 or later.
- **Capital VSTAR**: Update to v2021.1 or later.
- Siemens recommends contacting local support for specific product line updates (e.g., SIMATIC, SINAMICS) as patches are released incrementally.
### Workarounds
- Disable unnecessary network services (FTP, TFTP, DHCP) if not required for operation.
- Implement network segmentation to isolate affected RTOS devices from the public internet.
- Use VPNs or encrypted tunnels for remote access to devices.
- Deploy firewalls to block malformed or unexpected traffic targeting the Nucleus TCP/IP stack.
## Detection
- **Indicators of compromise**: Unusual device reboots, network stack instability, or unauthorized FTP/TFTP connection attempts.
- **Detection methods and tools**:
- Use IDS/IPS signatures specifically designed to detect NUCLEUS:13 exploits (available via major security vendors).
- Monitor network traffic for malformed DHCP or FTP packets.
## References
- **Vendor Advisory**: hxxps[://]cert-portal[.]siemens[.]com/productcert/pdf/ssa-044112[.]pdf
- **Forescout Research**: hxxps[://]www[.]forescout[.]com/blog/new-critical-vulnerabilities-affecting-nucleus-rtos/