8.1
CVE-2021-27395
- EPSS 0.25%
- Veröffentlicht 12.10.2021 10:15:11
- Zuletzt bearbeitet 21.11.2024 05:57:54
- Quelle productcert@siemens.com
- Teams Watchlist Login
- Unerledigt Login
A vulnerability has been identified in SIMATIC Process Historian 2013 and earlier (All versions), SIMATIC Process Historian 2014 (All versions < SP3 Update 6), SIMATIC Process Historian 2019 (All versions), SIMATIC Process Historian 2020 (All versions). An interface in the software that is used for critical functionalities lacks authentication, which could allow a malicious user to maliciously insert, modify or delete data.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Siemens ≫ Simatic Process Historian 2014 Version- Updatesp1
Siemens ≫ Simatic Process Historian 2014 Version- Updatesp2
Siemens ≫ Simatic Process Historian 2014 Version- Updatesp3
Siemens ≫ Simatic Process Historian 2014 Version- Updatesp3_update4
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.25% | 0.451 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 8.1 | 2.8 | 5.2 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
|
| nvd@nist.gov | 5.5 | 8 | 4.9 |
AV:N/AC:L/Au:S/C:N/I:P/A:P
|
CWE-306 Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.