7.8
CVE-2021-31893
- EPSS 0.13%
- Published 13.07.2021 11:15:09
- Last modified 21.11.2024 06:06:26
- Source productcert@siemens.com
- Teams watchlist Login
- Open Login
A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3), SIMATIC PDM (All versions < V9.2), SIMATIC STEP 7 V5.X (All versions < V5.6 SP2 HF3), SINAMICS STARTER (containing STEP 7 OEM version) (All versions < V5.4 HF2). The affected software contains a buffer overflow vulnerability while handling certain files that could allow a local attacker to trigger a denial-of-service condition or potentially lead to remote code execution.
Data is provided by the National Vulnerability Database (NVD)
Siemens ≫ Simatic Pcs Firmware Version <= 8.2
Siemens ≫ Simatic Pcs Firmware Version9.0 Update-
Siemens ≫ Simatic Pcs Firmware Version9.0 Updatesp1
Siemens ≫ Simatic Pcs Firmware Version9.0 Updatesp2
Siemens ≫ Simatic Pdm Firmware Version < 9.2
Siemens ≫ Simatic Step 7 Firmware Version <= 5.6
Siemens ≫ Sinamics Starter Firmware Version < 5.4
Siemens ≫ Sinamics Starter Firmware Version5.4 Update-
Siemens ≫ Sinamics Starter Firmware Version5.4 Updatehotfix_1
Siemens ≫ Sinamics Starter Firmware Version5.4 Updatehotfix_2
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.13% | 0.336 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 7.8 | 1.8 | 5.9 |
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 7.2 | 3.9 | 10 |
AV:L/AC:L/Au:N/C:C/I:C/A:C
|
CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.