Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-31892


A vulnerability has been identified in SINUMERIK Analyse MyCondition (All versions), SINUMERIK Analyze MyPerformance (All versions), SINUMERIK Analyze MyPerformance /OEE-Monitor (All versions), SINUMERIK Analyze MyPerformance /OEE-Tuning (All versions), SINUMERIK Integrate Client 02 (All versions >= V02.00.12 < 02.00.18), SINUMERIK Integrate Client 03 (All versions >= V03.00.12 < 03.00.18), SINUMERIK Integrate Client 04 (V04.00.02 and all versions >= V04.00.15 < 04.00.18), SINUMERIK Integrate for Production 4.1 (All versions < V4.1 SP10 HF3), SINUMERIK Integrate for Production 5.1 (V5.1), SINUMERIK Manage MyMachines (All versions), SINUMERIK Manage MyMachines /Remote (All versions), SINUMERIK Manage MyMachines /Spindel Monitor (All versions), SINUMERIK Manage MyPrograms (All versions), SINUMERIK Manage MyResources /Programs (All versions), SINUMERIK Manage MyResources /Tools (All versions), SINUMERIK Manage MyTools (All versions), SINUMERIK Operate V4.8 (All versions < V4.8 SP8), SINUMERIK Operate V4.93 (All versions < V4.93 HF7), SINUMERIK Operate V4.94 (All versions < V4.94 HF5), SINUMERIK Optimize MyProgramming /NX-Cam Editor (All versions). Due to an error in a third-party dependency the ssl flags used for setting up a TLS connection to a server are overwitten with wrong settings. This results in a missing validation of the server certificate and thus in a possible TLS MITM szenario.


Security Impact Summary

This vulnerability carries a HIGH severity rating with a CVSS v3.1 score of 7.4, indicating it can be exploited remotely over the network but requires specific conditions to be met without requiring user interaction and does not require pre-existing privileges . The vulnerability impacts confidentiality (data exposure), integrity (unauthorized modifications), for affected systems. Impacting 20 products from siemens, from siemens, from siemens and 17 others, organizations running these solutions should prioritize assessment and patching.

Historical Context

Reported in 2021, this vulnerability emerged during an era marked by increased sophistication in supply chain attacks, cloud infrastructure vulnerabilities, and software-as-a-service (SaaS) security challenges. Security practices during this period emphasized zero-trust architectures, container security, and API protection.


Published

2021-07-13T11:15:09.453

Last Modified

2024-11-21T06:06:26.830

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.4 (HIGH)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: NONE
Exploitability Score

8.6

Impact Score

4.9

Weaknesses
  • Type: Secondary
    CWE-295

Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System siemens sinumerik_analyse_mycondition_firmware - Yes
Hardware siemens sinumerik_analyse_mycondition - No
Operating System siemens sinumerik_analyze_myperformance_firmware - Yes
Hardware siemens sinumerik_analyze_myperformance - No
Operating System siemens sinumerik_integrate_client_firmware < 2.00.18 Yes
Operating System siemens sinumerik_integrate_client_firmware < 3.00.18 Yes
Operating System siemens sinumerik_integrate_client_firmware < 4.00.18 Yes
Hardware siemens sinumerik_integrate_client - No
Operating System siemens sinumerik_integrate_for_production_firmware ≤ 4.1 Yes
Operating System siemens sinumerik_integrate_for_production_firmware 5.1 Yes
Hardware siemens sinumerik_integrate_for_production - No
Operating System siemens sinumerik_manage_mymachines_firmware - Yes
Hardware siemens sinumerik_manage_mymachines - No
Operating System siemens sinumerik_manage_myprograms_firmware - Yes
Hardware siemens sinumerik_manage_myprograms - No
Operating System siemens sinumerik_manage_myresources_firmware - Yes
Hardware siemens sinumerik_manage_myresources - No
Operating System siemens sinumerik_manage_mytools_firmware - Yes
Hardware siemens sinumerik_manage_mytools - No
Operating System siemens sinumerik_operate_firmware < 4.8 Yes
Operating System siemens sinumerik_operate_firmware 4.8 Yes
Operating System siemens sinumerik_operate_firmware 4.8 Yes
Operating System siemens sinumerik_operate_firmware 4.8 Yes
Operating System siemens sinumerik_operate_firmware 4.8 Yes
Operating System siemens sinumerik_operate_firmware 4.8 Yes
Operating System siemens sinumerik_operate_firmware 4.8 Yes
Operating System siemens sinumerik_operate_firmware 4.8 Yes
Operating System siemens sinumerik_operate_firmware 4.8 Yes
Operating System siemens sinumerik_operate_firmware 4.93 Yes
Operating System siemens sinumerik_operate_firmware 4.93 Yes
Operating System siemens sinumerik_operate_firmware 4.93 Yes
Operating System siemens sinumerik_operate_firmware 4.93 Yes
Operating System siemens sinumerik_operate_firmware 4.93 Yes
Operating System siemens sinumerik_operate_firmware 4.93 Yes
Operating System siemens sinumerik_operate_firmware 4.93 Yes
Operating System siemens sinumerik_operate_firmware 4.94 Yes
Operating System siemens sinumerik_operate_firmware 4.94 Yes
Operating System siemens sinumerik_operate_firmware 4.94 Yes
Operating System siemens sinumerik_operate_firmware 4.94 Yes
Operating System siemens sinumerik_operate_firmware 4.94 Yes
Hardware siemens sinumerik_operate - No
Operating System siemens sinumerik_optimize_myprogramming_firmware - Yes
Hardware siemens sinumerik_optimize_myprogramming - No

References

How SecUtils Interprets This CVE

SecUtils normalizes and enriches National Vulnerability Database (NVD) records by standardizing vendor and product identifiers, aggregating vulnerability metadata from both NVD and MITRE sources, and providing structured context for security teams. For siemens's affected products, we extract Common Platform Enumeration (CPE) data, Common Weakness Enumeration (CWE) classifications, CVSS severity metrics, and reference data to enable rapid vulnerability prioritization and asset correlation. This record contains no exploit code, proof-of-concept instructions, or attack methodologies—only defensive intelligence necessary for patch management, risk assessment, and security operations.