CVE-2021-40364

EPSS 0.23%
Veröffentlicht 09.11.2021 12:15:10
Zuletzt bearbeitet 21.11.2024 06:23:57
Erkennungen
Login

A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC04), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMATIC WinCC V15 and earlier (All versions < V15 SP1 Update 7), SIMATIC WinCC V16 (All versions < V16 Update 5), SIMATIC WinCC V17 (All versions < V17 Update 2), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 19), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 5). The affected systems store sensitive information in log files. An attacker with access to the log files could publicly expose the information or reuse it to develop further attacks on the system.

Betroffene Produkte Warnungen 0 Metriken 4 CWE 1 Referenzen 4

NVD 21 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Siemens ≫ Simatic Pcs 7 Version <= 8.2

Siemens ≫ Simatic Pcs 7 Version >= 9.0 < 9.1

Siemens ≫ Simatic Pcs 7 Version 9.1 Update -

Siemens ≫ Simatic Wincc Version <= 7.4

Siemens ≫ Simatic Wincc Version 7.5 Update -

Siemens ≫ Simatic Wincc Version 7.5 Update sp1

Siemens ≫ Simatic Wincc Version 7.5 Update sp1_update1

Siemens ≫ Simatic Wincc Version 7.5 Update sp1_update2

Siemens ≫ Simatic Wincc Version 7.5 Update sp2

Siemens ≫ Simatic Wincc Version 7.5 Update sp2_update1

Siemens ≫ Simatic Wincc Version 7.5 Update sp2_update2

Siemens ≫ Simatic Wincc Version 7.5 Update sp2_update3

Siemens ≫ Simatic Wincc Version 7.5 Update sp2_update4

Siemens ≫ Simatic Wincc Version 15

Siemens ≫ Simatic Wincc Version 16 Update -

Siemens ≫ Simatic Wincc Version 16 Update update1

Siemens ≫ Simatic Wincc Version 16 Update update2

Siemens ≫ Simatic Wincc Version 16 Update update3

Siemens ≫ Simatic Wincc Version 16 Update update4

Siemens ≫ Simatic Wincc Version 17 Update -

Siemens ≫ Simatic Wincc Version 17 Update update1

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.23%	0.139

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	2.1	3.9	2.9	AV:L/AC:L/Au:N/C:P/I:N/A:N
NIST	5.5	1.8	3.6	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Siemens	5.5	1.8	3.6	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE-532 Insertion of Sensitive Information into Log File

The product writes sensitive information to a log file.

https://cert-portal.siemens.com/productcert/pdf/ssa-840188.pdf

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2021-40364

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2021-40364

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2021-40364

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2021-40364