Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-31894

A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.X (All versions < V9.1 SP2), SIMATIC PDM (All versions < V9.2 SP2), SIMATIC STEP 7 V5.X (All versions < V5.7), SINAMICS STARTER (containing STEP 7 OEM version) (All versions < V5.4 SP2 HF1). A directory containing metafiles relevant to devices' configurations has write permissions. An attacker could leverage this vulnerability by changing the content of certain metafiles and subsequently manipulate parameters or behavior of devices that would be later configured by the affected software.

Published

2021-07-13T11:15:09.603

Last Modified

2024-11-21T06:06:27.113

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 8.8 (HIGH)

CVSSv2 Vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

  • Access Vector: LOCAL
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: COMPLETE
  • Integrity Impact: COMPLETE
  • Availability Impact: COMPLETE
Exploitability Score

3.9

Impact Score

10.0

Weaknesses
  • Type: Primary
    CWE-732
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System siemens simatic_pcs_7_firmware ≤ 8.2 Yes
Operating System siemens simatic_pcs_7_firmware 9.0 Yes
Hardware siemens simatic_pcs_7 - No
Operating System siemens simatic_pdm_firmware - Yes
Hardware siemens simatic_pdm - No
Operating System siemens simatic_step_7_firmware < 5.7 Yes
Hardware siemens simatic_step_7 - No
Operating System siemens sinamics_starter_firmware < 5.4 Yes
Operating System siemens sinamics_starter_firmware 5.4 Yes
Operating System siemens sinamics_starter_firmware 5.4 Yes
Operating System siemens sinamics_starter_firmware 5.4 Yes
Operating System siemens sinamics_starter_firmware 5.4 Yes
Operating System siemens sinamics_starter_firmware 5.4 Yes
Operating System siemens sinamics_starter_firmware 5.4 Yes
Hardware siemens sinamics_starter - No
References