Full Report
The FTP server of the networking component (Nucleus NET) in Nucleus Real-Time Operating System (RTOS) does not properly release memory resources that were reserved for incomplete connection attempts by FTP clients. This could allow a remote attacker to generate a denial of service condition on devices that incorporate a vulnerable version of the FTP server. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens is preparing further updates and recommends specific countermeasures for products where updates are not, or not yet available.
Analysis Summary
# Vulnerability: Nucleus NET FTP Server Resource Exhaustion
## CVE Details
- **CVE ID:** CVE-2021-31346
- **CVSS Score:** 7.5 (High)
- **CWE:** CWE-400 (Uncontrolled Resource Consumption)
## Affected Systems
- **Products:** Siemens products incorporating the Nucleus Real-Time Operating System (RTOS) with the Nucleus NET networking component.
- **Versions:** All versions of Nucleus NET containing the FTP server component prior to the latest security updates.
- **Configurations:** Systems where the FTP server service is enabled and reachable over the network.
## Vulnerability Description
The vulnerability exists within the FTP server component of the Nucleus NET stack. The software fails to properly release memory resources allocated during the initial phases of an FTP connection attempt. If a connection is initiated but not completed, the reserved memory remains "orphaned" and unavailable to the system. By repeatedly initiating incomplete connections, an attacker can exhaust the device's available memory.
## Exploitation
- **Status:** Not exploited in the wild (as of initial report); PoC not publicly detailed in the provided text.
- **Complexity:** Low (requires simple network connection attempts without authentication).
- **Attack Vector:** Network (Remote).
## Impact
- **Confidentiality:** None
- **Integrity:** None
- **Availability:** High (Denial of Service - leads to system instability, service crashes, or total device unresponsiveness).
## Remediation
### Patches
- Siemens has released updates for several affected product lines.
- **Action:** Users should consult the specific Siemens ProductCERT portal for their device model and update to the latest recommended firmware/software version.
### Workarounds
For products where updates are not yet available, Siemens recommends:
- **Disable FTP:** If the FTP service is not mission-critical, disable it entirely.
- **Network Segmentation:** Place vulnerable devices behind firewalls and restrict access to the FTP port (typically TCP 21) to trusted internal hosts only.
- **VPN:** Use secure VPN tunnels for remote access to the FTP service.
## Detection
- **Indicators of Compromise:** Unusual increase in memory consumption followed by system crashes; high volume of half-open TCP connections on port 21 from a single or distributed set of IP addresses.
- **Detection methods and tools:** Network monitoring (IDS/IPS) for anomalous connection patterns to FTP services; system health monitoring for memory leak patterns.
## References
- **Vendor Advisories:** Siemens ProductCERT
- **Relevant links:** hxxps[://]cert-portal[.]siemens[.]com[/]productcert[/]pdf[/]ssa-281638[.]pdf
- **NVD Link:** hxxps[://]nvd[.]nist[.]gov[/]vuln[/]detail[/]CVE-2021-31346