CVE-2021-25667: Siemens Ruggedcom RM1224 Firmware

High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days.

A vulnerability has been identified in RUGGEDCOM RM1224 (All versions >= V4.3 and < V6.4), SCALANCE M-800 (All versions >= V4.3 and < V6.4), SCALANCE S615 (All versions >= V4.3 and < V6.4), SCALANCE SC-600 Family (All versions >= V2.0 and < V2.1.3), SCALANCE XB-200 (All versions < V4.1), SCALANCE XC-200 (All versions < V4.1), SCALANCE XF-200BA (All versions < V4.1), SCALANCE XM400 (All versions < V6.2), SCALANCE XP-200 (All versions < V4.1), SCALANCE XR-300WG (All versions < V4.1), SCALANCE XR500 (All versions < V6.2). Affected devices contain a stack-based buffer overflow vulnerability in the handling of STP BPDU frames that could allow a remote attacker to trigger a denial-of-service condition or potentially remote code execution. Successful exploitation requires the passive listening feature of the device to be active.

Affected products

  • Siemens Ruggedcom RM1224 Firmware: from 4.3, before 6.4 (fixed in 6.4)
  • Siemens Scalance M-800 Firmware: from 4.3, before 6.4 (fixed in 6.4)
  • Siemens Scalance s615 Firmware: from 4.3, before 6.4 (fixed in 6.4)
  • Siemens Scalance SC622-2c Firmware: up to and including 2.0; from 2.1, before 2.1.3 (fixed in 2.1.3)
  • Siemens Scalance SC632-2c Firmware: up to and including 2.0; from 2.1, before 2.1.3 (fixed in 2.1.3)
  • Siemens Scalance SC636-2c Firmware: up to and including 2.0; from 2.1, before 2.1.3 (fixed in 2.1.3)
  • Siemens Scalance SC642-2c Firmware: up to and including 2.0; from 2.1, before 2.1.3 (fixed in 2.1.3)
  • Siemens Scalance SC646-2c Firmware: up to and including 2.0; from 2.1, before 2.1.3 (fixed in 2.1.3)
  • Siemens Scalance x300wg Firmware: before 4.1 (fixed in 4.1)
  • Siemens Scalance Xb-200 Firmware: before 4.1 (fixed in 4.1)
  • Siemens Scalance Xc-200 Firmware: before 4.1 (fixed in 4.1)
  • Siemens Scalance Xf-200ba Firmware: before 4.1 (fixed in 4.1)
  • Siemens Scalance XM400 Firmware: before 6.2 (fixed in 6.2)
  • Siemens Scalance XP-200 Firmware: before 4.1 (fixed in 4.1)
  • Siemens Scalance XR500 Firmware: before 6.2 (fixed in 6.2)

Published 2021-03-15. Last modified 2026-06-17.