Siemens Capital Embedded AR Classic Nucleus RTOS Vulnerabilities (SSA-620288)

Key Information: 1. Vulnerability ID: - SSA-620288 2. Affected Products: - Capital Embedded AR Classic - Capital Embedded AR Classic R20-11 3. Vulnerability Description: - Multiple vulnerabilities (also referred to as “NUCLEUS:13”) exist in the Nucleus RTOS (Real-Time Operating System) and were reported in Siemens Security Advisory SSA-044112. - Capital Embedded AR Classic uses the affected Nucleus software and therefore includes these vulnerabilities. 4. Affected Versions: - All versions - Versions < V2303 5. Remediation Recommendation: - Upgrade to V2303 or later - Refer to the “Workspace and Mitigation Measures” section for further recommendations 6. Workspace and Mitigation Measures: - Implement network segmentation and ensure ECUs are placed behind properly configured gateways/firewalls - Disable DHCP client functionality; if not in use, uncheck the TcplpV4General/TcplpDhcpClientEnabled Pre-Compile configuration option 7. General Security Recommendations: - Strongly recommended to protect network-accessible devices using appropriate security mechanisms. - Configure the environment in accordance with Siemens’ industrial security operational guidelines. 8. Product Description: - Describes all vulnerabilities mentioned in the security advisory (CVE-IDs). - Documents the specific impact on affected products. 9. Vulnerability Details: - Includes detailed information on multiple vulnerabilities, such as CVE-2021-31344, CVE-2021-31345, etc. - CVSS scores, vectors, and CWE numbers for each vulnerability. 10. Historical Data: - Version 1.0 (2021-12-14): Initial release date - Version 1.1 (2022-11-08): Removed CVE-2021-31884, as Capital VSTAR is not affected - Version 1.2 (2024-10-08): Renamed Capital VSTAR to Capital Embedded AR Classic; added fix for version line R20-11 11. Terms of Use: - Siemens Security Advisory is subject to Siemens’ licensing terms or any other applicable agreements. Summary: This security advisory details multiple vulnerabilities affecting Capital Embedded AR Classic and Capital Embedded AR Classic R20-11. Users are advised to upgrade to the latest version or implement specific mitigation measures to reduce risk.

Goal Reached Thanks to every supporter — we hit 100%!

Siemens Capital Embedded AR Classic Nucleus RTOS Vulnerabilities (SSA-620288)