7.5
CVE-2021-45034
- EPSS 0.63%
- Published 11.01.2022 12:15:10
- Last modified 21.11.2024 06:31:50
- Source productcert@siemens.com
- Teams watchlist Login
- Open Login
A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions < V16.20), CP-8000 MASTER MODULE WITH I/O -40/+70°C (All versions < V16.20), CP-8021 MASTER MODULE (All versions < V16.20), CP-8022 MASTER MODULE WITH GPRS (All versions < V16.20). The web server of the affected system allows access to logfiles and diagnostic data generated by a privileged user. An unauthenticated attacker could access the files by knowing the corresponding download links.
Data is provided by the National Vulnerability Database (NVD)
Siemens ≫ Cp-8000 Master Module With I/o -25/+70 Firmware Version < 16.20
Siemens ≫ Cp-8000 Master Module With I/o -40/+70 Firmware Version < 16.20
Siemens ≫ Cp-8021 Master Module Firmware Version < 16.20
Siemens ≫ Cp-8022 Master Module With Gprs Firmware Version < 16.20
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.63% | 0.69 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 7.5 | 3.9 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
|
| nvd@nist.gov | 4.3 | 8.6 | 2.9 |
AV:N/AC:M/Au:N/C:P/I:N/A:N
|
CWE-284 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-532 Insertion of Sensitive Information into Log File
The product writes sensitive information to a log file.