CVE-2021-31346: Nucleus NET TCP/IP Software Modem TCP Protocol Input Validation Flaw
Summary
CVE-2021-31346: In Modem TCP protocol integrated from Nucleus NET TCP/IP software, there is a possible system crash due to an improper input validation. Affects :unknown: versions >= SoCVersion:0, < SoCVersion:2022-01-05. Fixed in SoCVersion:2022-01-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Nucleus NET is a TCP/IP software suite designed for embedded systems, providing essential networking capabilities. It is widely used in various applications, including telecommunications and IoT devices. The Modem TCP protocol within Nucleus NET is responsible for managing TCP connections, but it has been found to be vulnerable due to improper input validation, which can lead to significant security risks.
Vulnerability Detail
The vulnerability identified as CVE-2021-31346 arises from an improper input validation in the Modem TCP protocol integrated into Nucleus NET TCP/IP software. This flaw can be exploited to cause a remote denial of service (DoS), leading to a potential system crash. The exploitation does not require any additional execution privileges, and user interaction is not necessary, making it a critical security concern for affected systems.
How To Fix
Minimum fixed version
SoCVersion:2022-01-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing network-level protections such as firewalls to restrict access to the Modem TCP protocol until the software can be updated. This can help mitigate the risk of exploitation while a permanent fix is being applied.
Conclusion
CVE-2021-31346 represents a significant vulnerability in the Nucleus NET TCP/IP software's Modem TCP protocol, which can lead to remote denial of service. It is essential to update to the patched version released on January 5, 2022, to mitigate this risk. Users should also consider temporary workarounds to protect their systems until the update can be applied.
See every vulnerability recorded for :unknown: →
FAQ
CVE-2021-31346 is a vulnerability in the Modem TCP protocol of Nucleus NET TCP/IP software that allows for remote denial of service due to improper input validation.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to assess your system without needing to sign up.
Exploitation of this vulnerability can lead to a system crash, resulting in a denial of service without requiring user interaction or additional privileges.
Yes, a patch was released on January 5, 2022. It is crucial to update to this version to protect against the vulnerability.
If immediate updates are not possible, implement network-level protections such as firewalls to limit access to the vulnerable protocol until the software can be updated.
References
Related vulnerabilities
Recent vulnerabilities recorded for :unknown:.
