CVE-2021-31881
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedA vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303). When processing a DHCP OFFER message, the DHCP client application does not validate the length of the Vendor option(s), leading to Denial-of-Service conditions. (FSMD-2021-0008)
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceThe DHCP client in Capital Embedded AR Classic fails to validate the length field of Vendor options within incoming DHCP OFFER messages. When a malicious or malformed DHCP OFFER contains an invalid length value in the Vendor-specific option, the client does not properly bounds-check, leading to a denial-of-service condition where the application crashes or becomes unresponsive.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE dataall versionsall versions< 2012.08all versionsall versionsall versionsall versionsall versionsCVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify the deployed Siemens productDetermine the exact product name and version running in your environment from system documentation, device labels, or management interfaces. Cross-reference against the list of affected products: Capital Vstar, Nucleus Net, Nucleus Readystart V3, Nucleus Source Code, Apogee Modular Building Controller Firmware, Apogee Modular Equipment Controller Firmware, Apogee PXC Compact Firmware, Apogee PXC Modular Firmware.Affected if The product matches one of the listed affected products and versions.
-
Confirm DHCP client is in useCheck if the system is configured to obtain IP addresses automatically via DHCP. This can be verified through network configuration settings, boot scripts, or network interface configuration files on the device.Affected if DHCP client functionality is enabled and the device acts as a DHCP client receiving OFFER messages from a server.
-
Check the version for Nucleus Readystart V3If the product is Nucleus Readystart V3, verify the installed version by checking the firmware revision, software build information, or product documentation. Compare the version against the threshold: versions prior to 2012.08 are affected.Affected if The product is Nucleus Readystart V3 with a version earlier than 2012.08.
-
Look for DHCP-related crashes or system instabilityReview system logs, crash dumps, or network monitoring data for incidents where the application became unresponsive or crashed immediately after DHCP lease renewal or after joining a network. Correlate these events with DHCP OFFER message processing timing.Affected if The system exhibits crashes or becomes unresponsive during or shortly after DHCP operations, particularly when receiving DHCP OFFER messages.
If the device runs any of the affected Siemens products (especially Nucleus Readystart V3 versions prior to 2012.08) and has an active DHCP client configuration, the environment may be vulnerable to CVE-2021-31881.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
From vendor data2012.08
Apply the vendor-supplied update (V2303 or later for R20-11) to obtain the patched DHCP client with proper Vendor option length validation. If patching is not immediately feasible, isolate affected devices on a dedicated network segment to limit exposure to untrusted DHCP servers.
- Consultation4.0 h
- Implementation2.0 h
- Testing4.0 h
- Review / QA2.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $3,392.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2021-31881 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2021-31881 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data