7.8

CVE-2021-40363

A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMATIC WinCC V15 and earlier (All versions < V15 SP1 Update 7), SIMATIC WinCC V16 (All versions < V16 Update 5), SIMATIC WinCC V17 (All versions < V17 Update 2), SIMATIC WinCC V17 (All versions <= V17 Update 4), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 19), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 6). The affected component stores the credentials of a local system account in a potentially publicly accessible project file using an outdated cipher algorithm. An attacker may use this to brute force the credentials and take over the system.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Siemens ≫ Simatic Pcs 7 Version <= 8.2
Siemens ≫ Simatic Pcs 7 Version 9.0 Update -
Siemens ≫ Simatic Pcs 7 Version 9.1 Update -
Siemens ≫ Simatic Wincc Version < 7.4
Siemens ≫ Simatic Wincc Version 7.4 Update -
Siemens ≫ Simatic Wincc Version 7.4 Update sp1
Siemens ≫ Simatic Wincc Version 7.4 Update sp1_update1
Siemens ≫ Simatic Wincc Version 7.4 Update sp1_update10
Siemens ≫ Simatic Wincc Version 7.4 Update sp1_update11
Siemens ≫ Simatic Wincc Version 7.4 Update sp1_update12
Siemens ≫ Simatic Wincc Version 7.4 Update sp1_update13
Siemens ≫ Simatic Wincc Version 7.4 Update sp1_update14
Siemens ≫ Simatic Wincc Version 7.4 Update sp1_update15
Siemens ≫ Simatic Wincc Version 7.4 Update sp1_update16
Siemens ≫ Simatic Wincc Version 7.4 Update sp1_update17
Siemens ≫ Simatic Wincc Version 7.4 Update sp1_update18
Siemens ≫ Simatic Wincc Version 7.4 Update sp1_update2
Siemens ≫ Simatic Wincc Version 7.4 Update sp1_update3
Siemens ≫ Simatic Wincc Version 7.4 Update sp1_update4
Siemens ≫ Simatic Wincc Version 7.4 Update sp1_update5
Siemens ≫ Simatic Wincc Version 7.4 Update sp1_update6
Siemens ≫ Simatic Wincc Version 7.4 Update sp1_update7
Siemens ≫ Simatic Wincc Version 7.4 Update sp1_update8
Siemens ≫ Simatic Wincc Version 7.4 Update sp1_update9
Siemens ≫ Simatic Wincc Version 7.4 Update update_1
Siemens ≫ Simatic Wincc Version 7.5 Update -
Siemens ≫ Simatic Wincc Version 7.5 Update sp1
Siemens ≫ Simatic Wincc Version 7.5 Update sp1_update1
Siemens ≫ Simatic Wincc Version 7.5 Update sp1_update2
Siemens ≫ Simatic Wincc Version 7.5 Update sp2
Siemens ≫ Simatic Wincc Version 7.5 Update sp2_update1
Siemens ≫ Simatic Wincc Version 7.5 Update sp2_update2
Siemens ≫ Simatic Wincc Version 7.5 Update sp2_update3
Siemens ≫ Simatic Wincc Version 7.5 Update sp2_update4
Siemens ≫ Simatic Wincc Version 7.5 Update sp2_update5
Siemens ≫ Simatic Wincc Version 13 Update -
Siemens ≫ Simatic Wincc Version 13 Update sp1
Siemens ≫ Simatic Wincc Version 13 Update sp2
Siemens ≫ Simatic Wincc Version 14.0.1
Siemens ≫ Simatic Wincc Version 15
Siemens ≫ Simatic Wincc Version 15.1 Update -
Siemens ≫ Simatic Wincc Version 15.1 Update update_1
Siemens ≫ Simatic Wincc Version 15.1 Update update_2
Siemens ≫ Simatic Wincc Version 15.1 Update update_3
Siemens ≫ Simatic Wincc Version 15.1 Update update_4
Siemens ≫ Simatic Wincc Version 15.1 Update update_5
Siemens ≫ Simatic Wincc Version 15.1 Update update_6
Siemens ≫ Simatic Wincc Version 16 Update -
Siemens ≫ Simatic Wincc Version 16 Update update1
Siemens ≫ Simatic Wincc Version 16 Update update2
Siemens ≫ Simatic Wincc Version 16 Update update3
Siemens ≫ Simatic Wincc Version 16 Update update4
Siemens ≫ Simatic Wincc Version 17 Update -
Siemens ≫ Simatic Wincc Version 17 Update update1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.16% 0.055
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NIST 2.1 3.9 2.9
AV:L/AC:L/Au:N/C:P/I:N/A:N
CWE-312 Cleartext Storage of Sensitive Information

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

CWE-538 Insertion of Sensitive Information into Externally-Accessible File or Directory

The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.

https://cert-portal.siemens.com/productcert/pdf/ssa-914168.pdf
Patch
Vendor Advisory