CVE-2021-31886: Siemens Nucleus Net RCE Vulnerability

CVE-2021-31886 Overview

CVE-2021-31886 is a stack-based buffer overflow in the File Transfer Protocol (FTP) server component shipped with Siemens Nucleus RTOS and a wide range of Siemens building automation products. The FTP server fails to validate the length of the USER command, allowing unauthenticated remote attackers to overflow a stack buffer. Successful exploitation can lead to Denial-of-Service conditions or Remote Code Execution on affected controllers. The flaw, tracked internally by Siemens as FSMD-2021-0010, impacts APOGEE, Desigo, TALON, and Nucleus ReadyStart product families used in industrial and building control environments.

Critical Impact
An unauthenticated attacker with network access to TCP port 21 can crash affected controllers or execute arbitrary code, disrupting building automation and HVAC systems.

Affected Products

Siemens Nucleus Net, Nucleus ReadyStart V3 (< V2017.02.4), and Nucleus Source Code
Siemens APOGEE PXC Compact/Modular (BACnet < V3.5.4, P2 Ethernet < V2.8.19), APOGEE MBC/MEC PPC, and TALON TC Compact/Modular (BACnet < V3.5.4)
Siemens Desigo PXC and PXM20-E controllers (all versions >= V2.3 and < V6.30.016)

Discovery Timeline

2021-11-09 - CVE-2021-31886 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-31886

Vulnerability Analysis

The vulnerability resides in the FTP server bundled with the Siemens Nucleus real-time operating system. When a client connects to TCP port 21 and issues the USER command, the server copies the supplied username into a fixed-size stack buffer without enforcing length boundaries. CWE-170 (Improper Null Termination) and CWE-787 (Out-of-Bounds Write) both contribute to the defect, allowing attacker-controlled data to overwrite adjacent stack memory, including saved return addresses.

Because the FTP service is exposed before authentication completes, the USER command is reachable by any network-adjacent attacker. The vulnerability is reachable over the network with low attack complexity and no user interaction. EPSS data places the probability of exploitation in the 87th percentile, reflecting wide attack surface across deployed building automation infrastructure.

Root Cause

The FTP command parser uses an unbounded copy operation when processing the USER argument. No length check precedes the copy, and the destination buffer lives on the stack frame of the handler function. A long username overwrites local variables, the saved frame pointer, and the return address, transferring control flow when the function returns.

Attack Vector

An attacker reaches the vulnerable code path by establishing a TCP connection to the FTP control port on an affected controller and transmitting a USER command followed by an overly long string. On platforms without stack canaries or address space layout randomization, the attacker stages shellcode or ROP gadgets in the overflowed buffer to gain code execution on the controller. On hardened builds, the same condition reliably crashes the FTP service and the surrounding RTOS task, producing a denial of service that interrupts building control operations.

The vulnerability is described in prose because no verified public proof-of-concept code is available. Refer to the Siemens Security Advisory SSA-044112 for vendor technical details.

Detection Methods for CVE-2021-31886

Indicators of Compromise

Unexpected reboots, watchdog resets, or task crashes on APOGEE, Desigo, or TALON controllers running vulnerable firmware
FTP control connections from non-administrative source addresses to TCP port 21 on building automation networks
Inbound FTP USER commands containing abnormally long argument strings or non-printable bytes

Detection Strategies

Inspect network traffic to operational technology (OT) segments for FTP sessions targeting Nucleus-based devices and alert on USER payloads exceeding typical username lengths (greater than 64 bytes).
Correlate controller availability loss with preceding FTP connections in centralized logs to identify exploitation attempts that produced denial-of-service outcomes.
Deploy intrusion detection signatures that match oversized FTP USER commands directed at known controller IP ranges.

Monitoring Recommendations

Enable continuous monitoring of north-south and east-west traffic between IT and OT zones, focusing on legacy protocols including FTP, BACnet, and P2 Ethernet.
Maintain an asset inventory of Nucleus-based controllers and alert on any new exposure of TCP port 21 to untrusted networks.
Forward syslog and SNMP traps from building automation systems to a centralized SIEM for retention and correlation.

How to Mitigate CVE-2021-31886

Immediate Actions Required

Apply Siemens-provided firmware updates to affected APOGEE, Desigo, TALON, and Nucleus ReadyStart products as listed in the vendor advisories.
Disable the FTP server on affected controllers if not required for operations, or restrict TCP port 21 access through firewall rules to a small set of management hosts.
Place all building automation controllers behind a dedicated OT firewall and segment them from corporate and internet-facing networks.

Patch Information

Siemens has released fixed firmware versions. Upgrade APOGEE PXC Compact/Modular BACnet to V3.5.4 or later, APOGEE PXC Compact/Modular P2 Ethernet to V2.8.19 or later, TALON TC Compact/Modular BACnet to V3.5.4 or later, Desigo PXC and PXM20-E controllers to V6.30.016 or later, and Nucleus ReadyStart V3 to V2017.02.4 or later. Refer to Siemens Security Advisory SSA-044112 and Siemens Security Advisory SSA-114589 for product-specific guidance.

Workarounds

Block inbound TCP port 21 traffic at the network perimeter and at OT zone boundaries using firewall access control lists.
Restrict FTP access to trusted engineering workstations using IP allow-listing on the controller or upstream firewall.
Follow Siemens operational guidelines for industrial security and the recommendations in ICS-CERT advisories for defense-in-depth on building automation networks.

bash

# Example firewall rule to block external FTP access to OT controllers
iptables -A FORWARD -p tcp --dport 21 -d 10.20.0.0/16 -j DROP
iptables -A FORWARD -p tcp --dport 21 -s 10.20.99.10 -d 10.20.0.0/16 -j ACCEPT