7.8

CVE-2021-40363

A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMATIC WinCC V15 and earlier (All versions < V15 SP1 Update 7), SIMATIC WinCC V16 (All versions < V16 Update 5), SIMATIC WinCC V17 (All versions < V17 Update 2), SIMATIC WinCC V17 (All versions <= V17 Update 4), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 19), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 6). The affected component stores the credentials of a local system account in a potentially publicly accessible project file using an outdated cipher algorithm. An attacker may use this to brute force the credentials and take over the system.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Siemens ≫ Simatic Pcs 7 Version <= 8.2
Siemens ≫ Simatic Pcs 7 Version9.0 Update-
Siemens ≫ Simatic Pcs 7 Version9.1 Update-
Siemens ≫ Simatic Wincc Version < 7.4
Siemens ≫ Simatic Wincc Version7.4 Update-
Siemens ≫ Simatic Wincc Version7.4 Updatesp1
Siemens ≫ Simatic Wincc Version7.4 Updatesp1_update1
Siemens ≫ Simatic Wincc Version7.4 Updatesp1_update10
Siemens ≫ Simatic Wincc Version7.4 Updatesp1_update11
Siemens ≫ Simatic Wincc Version7.4 Updatesp1_update12
Siemens ≫ Simatic Wincc Version7.4 Updatesp1_update13
Siemens ≫ Simatic Wincc Version7.4 Updatesp1_update14
Siemens ≫ Simatic Wincc Version7.4 Updatesp1_update15
Siemens ≫ Simatic Wincc Version7.4 Updatesp1_update16
Siemens ≫ Simatic Wincc Version7.4 Updatesp1_update17
Siemens ≫ Simatic Wincc Version7.4 Updatesp1_update18
Siemens ≫ Simatic Wincc Version7.4 Updatesp1_update2
Siemens ≫ Simatic Wincc Version7.4 Updatesp1_update3
Siemens ≫ Simatic Wincc Version7.4 Updatesp1_update4
Siemens ≫ Simatic Wincc Version7.4 Updatesp1_update5
Siemens ≫ Simatic Wincc Version7.4 Updatesp1_update6
Siemens ≫ Simatic Wincc Version7.4 Updatesp1_update7
Siemens ≫ Simatic Wincc Version7.4 Updatesp1_update8
Siemens ≫ Simatic Wincc Version7.4 Updatesp1_update9
Siemens ≫ Simatic Wincc Version7.4 Updateupdate_1
Siemens ≫ Simatic Wincc Version7.5 Update-
Siemens ≫ Simatic Wincc Version7.5 Updatesp1
Siemens ≫ Simatic Wincc Version7.5 Updatesp1_update1
Siemens ≫ Simatic Wincc Version7.5 Updatesp1_update2
Siemens ≫ Simatic Wincc Version7.5 Updatesp2
Siemens ≫ Simatic Wincc Version7.5 Updatesp2_update1
Siemens ≫ Simatic Wincc Version7.5 Updatesp2_update2
Siemens ≫ Simatic Wincc Version7.5 Updatesp2_update3
Siemens ≫ Simatic Wincc Version7.5 Updatesp2_update4
Siemens ≫ Simatic Wincc Version7.5 Updatesp2_update5
Siemens ≫ Simatic Wincc Version13 Update-
Siemens ≫ Simatic Wincc Version13 Updatesp1
Siemens ≫ Simatic Wincc Version13 Updatesp2
Siemens ≫ Simatic Wincc Version14.0.1
Siemens ≫ Simatic Wincc Version15
Siemens ≫ Simatic Wincc Version15.1 Update-
Siemens ≫ Simatic Wincc Version15.1 Updateupdate_1
Siemens ≫ Simatic Wincc Version15.1 Updateupdate_2
Siemens ≫ Simatic Wincc Version15.1 Updateupdate_3
Siemens ≫ Simatic Wincc Version15.1 Updateupdate_4
Siemens ≫ Simatic Wincc Version15.1 Updateupdate_5
Siemens ≫ Simatic Wincc Version15.1 Updateupdate_6
Siemens ≫ Simatic Wincc Version16 Update-
Siemens ≫ Simatic Wincc Version16 Updateupdate1
Siemens ≫ Simatic Wincc Version16 Updateupdate2
Siemens ≫ Simatic Wincc Version16 Updateupdate3
Siemens ≫ Simatic Wincc Version16 Updateupdate4
Siemens ≫ Simatic Wincc Version17 Update-
Siemens ≫ Simatic Wincc Version17 Updateupdate1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.03% 0.055
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 2.1 3.9 2.9
AV:L/AC:L/Au:N/C:P/I:N/A:N
CWE-312 Cleartext Storage of Sensitive Information

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

CWE-538 Insertion of Sensitive Information into Externally-Accessible File or Directory

The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.