5.5

CVE-2021-40364

A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC04), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMATIC WinCC V15 and earlier (All versions < V15 SP1 Update 7), SIMATIC WinCC V16 (All versions < V16 Update 5), SIMATIC WinCC V17 (All versions < V17 Update 2), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 19), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 5). The affected systems store sensitive information in log files. An attacker with access to the log files could publicly expose the information or reuse it to develop further attacks on the system.

Data is provided by the National Vulnerability Database (NVD)
Siemens ≫ Simatic Pcs 7 Version <= 8.2
Siemens ≫ Simatic Pcs 7 Version >= 9.0 < 9.1
Siemens ≫ Simatic Pcs 7 Version9.1 Update-
Siemens ≫ Simatic Wincc Version <= 7.4
Siemens ≫ Simatic Wincc Version7.5 Update-
Siemens ≫ Simatic Wincc Version7.5 Updatesp1
Siemens ≫ Simatic Wincc Version7.5 Updatesp1_update1
Siemens ≫ Simatic Wincc Version7.5 Updatesp1_update2
Siemens ≫ Simatic Wincc Version7.5 Updatesp2
Siemens ≫ Simatic Wincc Version7.5 Updatesp2_update1
Siemens ≫ Simatic Wincc Version7.5 Updatesp2_update2
Siemens ≫ Simatic Wincc Version7.5 Updatesp2_update3
Siemens ≫ Simatic Wincc Version7.5 Updatesp2_update4
Siemens ≫ Simatic Wincc Version15
Siemens ≫ Simatic Wincc Version16 Update-
Siemens ≫ Simatic Wincc Version16 Updateupdate1
Siemens ≫ Simatic Wincc Version16 Updateupdate2
Siemens ≫ Simatic Wincc Version16 Updateupdate3
Siemens ≫ Simatic Wincc Version16 Updateupdate4
Siemens ≫ Simatic Wincc Version17 Update-
Siemens ≫ Simatic Wincc Version17 Updateupdate1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.05% 0.162
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 2.1 3.9 2.9
AV:L/AC:L/Au:N/C:P/I:N/A:N
nvd@nist.gov 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
productcert@siemens.com 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE-532 Insertion of Sensitive Information into Log File

The product writes sensitive information to a log file.