CVE-2021-29998: Wind River VxWorks Buffer Overflow Flaw

CVE-2021-29998 Overview

CVE-2021-29998 is a heap overflow vulnerability in the Dynamic Host Configuration Protocol (DHCP) client of Wind River VxWorks before version 6.5. The flaw allows a network-adjacent attacker to corrupt heap memory during DHCP message processing, potentially leading to remote code execution or denial of service. Because VxWorks is a real-time operating system (RTOS) embedded in industrial control systems, the vulnerability affects a wide range of Siemens products, including SCALANCE switches, RUGGEDCOM WIN devices, SIMATIC RF readers, and SINAMICS drives. The weakness is classified as an out-of-bounds write [CWE-787].

Critical Impact

Unauthenticated attackers on the local network can trigger heap corruption in the VxWorks DHCP client, with the potential to execute arbitrary code on industrial control devices.

Affected Products

• Wind River VxWorks versions prior to 6.5
• Siemens SCALANCE X-200, X-300, X-400, and XF-200 series industrial Ethernet switches
• Siemens RUGGEDCOM WIN Subscriber Station, SIMATIC RF 181-EIP, SIMATIC RF 182C, and SINAMICS PERFECT HARMONY GH180

Discovery Timeline

• 2021-04-13 - CVE-2021-29998 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-29998

Vulnerability Analysis

The vulnerability resides in the VxWorks DHCP client implementation, which processes DHCP server responses during network configuration. When parsing a crafted DHCP message, the client writes data past the bounds of a heap-allocated buffer, corrupting adjacent memory structures. Because DHCP runs early in the network stack and requires no authentication, an attacker on the same broadcast domain can deliver malicious responses by spoofing or impersonating a DHCP server.

VxWorks is widely deployed in operational technology (OT) environments, including Siemens industrial switches and process control hardware. Heap corruption on these embedded devices can disrupt manufacturing lines, energy distribution, and transportation systems. In a worst-case scenario, the overflow may be shaped into a write primitive that overwrites function pointers or control structures, enabling code execution in kernel context.

Root Cause

The root cause is improper validation of length fields and option data inside DHCP packets. The client trusts attacker-controlled size values when copying option payloads into a fixed heap buffer, leading to an out-of-bounds write [CWE-787]. The bug class is consistent with other issues discovered in legacy embedded network stacks, where input from untrusted sources is parsed without strict bounds enforcement.

Attack Vector

Exploitation requires only network adjacency. An attacker connects to the same Layer 2 segment as the vulnerable device and waits for, or forces, a DHCP renewal. By responding faster than the legitimate DHCP server, or by acting as a rogue server, the attacker sends a malformed DHCPOFFER or DHCPACK containing oversized option fields. The vulnerable client copies the attacker-supplied payload into its heap buffer and overflows it. No user interaction or credentials are required.

No public proof-of-concept exploit code is referenced in the available data. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Siemens Security Advisory SSA-560465 and CISA ICS Advisory ICSA-21-194-12 for vendor technical context.

Detection Methods for CVE-2021-29998

Indicators of Compromise

• Unexpected DHCP OFFER or ACK packets containing abnormally large option fields or malformed length values
• Multiple DHCP servers responding on a segment where only one authorized server should exist
• Embedded VxWorks devices that reboot, crash, or lose network connectivity shortly after DHCP lease renewal
• New or unrecognized MAC addresses serving DHCP responses on industrial VLANs

Detection Strategies

• Deploy passive network monitoring on OT segments to inspect DHCP traffic for protocol anomalies and oversized options
• Use ICS-aware intrusion detection systems with signatures for VxWorks DHCP exploitation attempts
• Correlate device crashes and unexpected reboots in asset management platforms with DHCP traffic captured around the same time window

Monitoring Recommendations

• Enable DHCP snooping on managed switches to block unauthorized DHCP server responses
• Centralize syslog and SNMP traps from SCALANCE, RUGGEDCOM, and SIMATIC devices to identify abnormal restart patterns
• Maintain an authoritative inventory of VxWorks-based assets and their firmware versions to scope exposure during incident response

How to Mitigate CVE-2021-29998

Immediate Actions Required

• Apply firmware updates from Wind River and Siemens that address the DHCP client heap overflow on all affected VxWorks-based devices
• Identify every device running VxWorks earlier than 6.5 and prioritize patching of internet-exposed or cross-zone assets
• Restrict DHCP traffic to trusted server addresses using switch-level DHCP snooping and ACLs

Patch Information

Wind River has released fixed versions of VxWorks. Consult the Wind River Security Notices portal for the specific patched releases. Siemens has published firmware updates and workarounds for affected product families in Siemens Security Advisory SSA-560465 and Siemens Security Advisory SSA-910883. Operators of industrial control systems should also review CISA ICS Advisory ICSA-21-194-12 for defense-in-depth guidance.

Workarounds

• Disable the DHCP client on devices that can use statically assigned IP addresses, removing the attack surface entirely
• Segment OT networks from IT networks using firewalls and enforce strict VLAN isolation around vulnerable devices
• Implement DHCP snooping and dynamic ARP inspection on access switches to prevent rogue DHCP servers from reaching VxWorks endpoints
• Place affected devices behind industrial firewalls that restrict Layer 2 broadcast traffic from untrusted sources

# Example: Cisco-style DHCP snooping configuration to block rogue DHCP servers
ip dhcp snooping
ip dhcp snooping vlan 10,20
no ip dhcp snooping information option
interface GigabitEthernet0/1
  description Authorized DHCP server uplink
  ip dhcp snooping trust
interface range GigabitEthernet0/2 - 24
  description OT device ports
  ip dhcp snooping limit rate 10