7.8
CVE-2021-31893
- EPSS 0.56%
- Veröffentlicht 13.07.2021 11:15:09
- Zuletzt bearbeitet 21.11.2024 06:06:26
- Erkennungen
LoginA vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3), SIMATIC PDM (All versions < V9.2), SIMATIC STEP 7 V5.X (All versions < V5.6 SP2 HF3), SINAMICS STARTER (containing STEP 7 OEM version) (All versions < V5.4 HF2). The affected software contains a buffer overflow vulnerability while handling certain files that could allow a local attacker to trigger a denial-of-service condition or potentially lead to remote code execution.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Siemens ≫ Simatic Pcs Firmware Version <= 8.2
Siemens ≫ Simatic Pcs Firmware Version 9.0 Update -
Siemens ≫ Simatic Pcs Firmware Version 9.0 Update sp1
Siemens ≫ Simatic Pcs Firmware Version 9.0 Update sp2
Siemens ≫ Simatic Pdm Firmware Version < 9.2
Siemens ≫ Simatic Step 7 Firmware Version <= 5.6
Siemens ≫ Sinamics Starter Firmware Version < 5.4
Siemens ≫ Sinamics Starter Firmware Version 5.4 Update -
Siemens ≫ Sinamics Starter Firmware Version 5.4 Update hotfix_1
Siemens ≫ Sinamics Starter Firmware Version 5.4 Update hotfix_2
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.56% | 0.423 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 7.8 | 1.8 | 5.9 |
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
|
| NIST | 7.2 | 3.9 | 10 |
AV:L/AC:L/Au:N/C:C/I:C/A:C
|
CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.
https://cert-portal.siemens.com/productcert/pdf/ssa-641963.pdf