Cyber Resilience

CVE-2021-25664

HighDDoS

Published: 22 April 2021

Published
22 April 2021
Modified
11 March 2025
KEV Added
—
Patch
—
CVSS Score v4 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0071 72.7th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2021-25664 is a high-severity Infinite Loop (CWE-835) vulnerability in Siemens Capital Vstar. Its CVSS base score is 8.7 (High).

Operationally, ranked in the top 27.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.4), Nucleus ReadyStart V4 (All versions < V4.1.0),…

more

Nucleus Source Code (All versions including affected IPv6 stack). The function that processes the Hop-by-Hop extension header in IPv6 packets and its options lacks any checks against the length field of the header, allowing attackers to put the function into an infinite loop by supplying arbitrary length values.

CWE(s)
CWE-835

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

siemens
capital vstar
all versions
siemens
nucleus net
all versions
siemens
nucleus readystart v3
≤ 2017.02.4
siemens
nucleus readystart v4
≤ 4.1.0
siemens
nucleus source code
all versions

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

CP-7 Alternate Processing Site
addresses: CWE-835

Enables transfer to alternate site if an infinite loop at the primary renders processing unavailable.

SC-5 Denial-of-service Protection
addresses: CWE-835

Detects and mitigates infinite loops that produce sustained resource consumption.

References