Search/CVE-2021-31884
● CVE — Critical

CVE-2021-31884

VendorsiemensProductapogee modular building controller firmware, apogee modular equiment controller firmware, capital vstar, desigo pxc00-e.d firmware, desigo pxc00-u firmware, desigo pxc001-e.d firmware, desigo pxc12-e.d firmware, desigo pxc22-e.d firmware, desigo pxc22.1-e.d firmware, desigo pxc36.1-e.d firmware, nucleus net, nucleus source code, nucleus readystart v3, apogee pxc compact firmware, apogee pxc modular firmware, talon tc compact firmware, talon tc modular firmware, desigo pxc100-e.d firmware, desigo pxc128-u firmware, desigo pxc200-e.d firmware, desigo pxc50-e.d firmware, desigo pxc64-u firmware, desigo pxm20-e firmwareDiscoveredNov 9, 2021UpdatedNov 21, 2024

A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions = V2.3 and = V2.3 and = V2.3 and = V2.3 and = V2.3 and = V2.3 and = V2.3 and = V2.3 and = V2.3 and = V2.3 and = V2.3 and = V2.3 and = V2.3 and < V6.30.016), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.4), Nucleus Source Code (All versions), TALON TC Compact (BACnet) (All versions < V3.5.4), TALON TC Modular (BACnet) (All versions < V3.5.4). The DHCP client application assumes that the data supplied with the “Hostname” DHCP option is NULL terminated. In cases when global hostname variable is not defined,…

View graph Watch Export
CVSS v3.1
9.8 CRITICAL
EPSS
1.50%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
0
sources referencing this CVE
Related IOCs
0
seen in the same coverage
EPSS Trend
Aug 16, 2026 → Sep 3, 2026
▲ 0.05pp
1.45% → 1.50% over 2 tracked changes
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
ConfidentialityHIGH
IntegrityHIGH
AvailabilityHIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Connections
24 relationships
Timeline
disclosure → media coverage
Nov 9, 2021
Disclosure — published as a CVE record. · last revised by NVD Nov 21, 2024