What’s Vulnerable › Vulnerabilities
CVE-2021-41991
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 5.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2021-10-18 · updated 2026-06-17
- Weakness: CWE-190
Description
The in-memory certificate cache in strongSwan before 5.9.4 has a remote integer overflow upon receiving many requests with different certificates to fill the cache and later trigger the replacement of cache entries. The code attempts to select a less-often-used cache entry by means of a random number generator, but this is not done correctly. Remote code execution might be a slight possibility.
Affected products
- Debian Linux: 9.0, 10.0, 11.0
- Fedoraproject Fedora: 33, 34, 35
- Siemens Cp 1543-1 Firmware: all versions
- Siemens Scalance Sc622-2C Firmware: all versions
- Siemens Scalance Sc632-2C Firmware: all versions
- Siemens Scalance Sc636-2C Firmware: all versions
- Siemens Scalance Sc642-2C Firmware: all versions
- Siemens Scalance Sc646-2C Firmware: before 2.3 — fixed in 2.3
- Siemens Simatic Cp 1242-7 Gprs V2 Firmware: all versions
- Siemens Simatic Cp 1243-1 Firmware: all versions
- Siemens Simatic Cp 1243-7 Lte/Us Firmware: all versions
- Siemens Simatic Cp 1542Sp-1 Firmware: all versions
- Siemens Simatic Cp 1542Sp-1 Irc Firmware: all versions
- Siemens Simatic Cp 1543Sp-1 Firmware: all versions
- Siemens Simatic Net Cp1243-7 Lte Eu Firmware: all versions
- Siemens Simatic Net Cp 1243-8 Irc Firmware: all versions
- Siemens Simatic Net Cp 1545-1 Firmware: all versions
- Siemens SINEMA Remote Connect Server: all versions
- Siemens Siplus Et 200Sp Cp 1542Sp-1 Irc Tx Rail Firmware: all versions
- Siemens Siplus Et 200Sp Cp 1543Sp-1 Isec Firmware: all versions
- Siemens Siplus Et 200Sp Cp 1543Sp-1 Isec Tx Rail Firmware: all versions
- Siemens Siplus Net Cp 1543-1 Firmware: all versions
- Siemens Siplus S7-1200 Cp 1243-1 Firmware: all versions
- Siemens Siplus S7-1200 Cp 1243-1 Rail Firmware: all versions
- strongSwan: from 4.2.10 before 5.9.4 — fixed in 5.9.4
How to fix
Upgrade to a fixed version: Siemens Scalance Sc646-2C Firmware 2.3; strongSwan 5.9.4. Check the vendor advisory for mitigations.
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-539476.pdf
- https://github.com/strongswan/strongswan/releases/tag/5.9.4
- https://lists.debian.org/debian-lts-announce/2021/10/msg00014.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5FJSATD2R2XHTG4P63GCMQ2N7EWKMME5/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WQSQ3BEC22NF4NCDZVCT4P3Q2ZIAJXGJ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3TQ32JLJOBJDB2EJKSX2PBPB5NFG2D4/
- https://www.debian.org/security/2021/dsa-4989
- https://www.strongswan.org/blog/2021/10/18/strongswan-vulnerability-%28cve-2021-41991%29.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-539476.pdf
- https://github.com/strongswan/strongswan/releases/tag/5.9.4
- https://lists.debian.org/debian-lts-announce/2021/10/msg00014.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5FJSATD2R2XHTG4P63GCMQ2N7EWKMME5/
Get alerted when CVE-2021-41991 or the next vulnerability affects your stack