CVE-2021-40360
Severity Score
8.8
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMATIC WinCC V15 and earlier (All versions < V15 SP1 Update 7), SIMATIC WinCC V16 (All versions < V16 Update 5), SIMATIC WinCC V17 (All versions < V17 Update 2), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 19), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 6). The password hash of a local user account in the remote server could be granted via public API to a user on the affected system. An authenticated attacker could brute force the password hash and use it to login to the server.
Se ha identificado una vulnerabilidad en SIMATIC PCS 7 V8.2 (Todas las versiones), SIMATIC PCS 7 V9.0 (Todas las versiones), SIMATIC PCS 7 V9.1 (Todas las versiones anteriores a V9. 1 SP1), SIMATIC WinCC V15 y anteriores (Todas las versiones anteriores a V15 SP1 Update 7), SIMATIC WinCC V16 (Todas las versiones anteriores a V16 Update 5), SIMATIC WinCC V17 (Todas las versiones anteriores a V17 Update 2), SIMATIC WinCC V7.4 (Todas las versiones anteriores a V7.4 SP1 Update 19), SIMATIC WinCC V7.5 (Todas las versiones anteriores a V7.5 SP2 Update 6). El hash de la contraseña de una cuenta de usuario local en el servidor remoto podría concederse a través de la API pública a un usuario del sistema afectado. Un atacante autenticado podría forzar el hash de la contraseña y utilizarlo para iniciar sesión en el servidor
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2021-09-01 CVE Reserved
- 2022-02-09 CVE Published
- 2023-09-02 EPSS Updated
- 2024-08-04 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
- CWE-522: Insufficiently Protected Credentials
CAPEC
References (1)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://cert-portal.siemens.com/productcert/pdf/ssa-914168.pdf | 2023-07-17 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Siemens Search vendor "Siemens" | Simatic Pcs 7 Search vendor "Siemens" for product "Simatic Pcs 7" | <= 8.2 Search vendor "Siemens" for product "Simatic Pcs 7" and version " <= 8.2" | - |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Pcs 7 Search vendor "Siemens" for product "Simatic Pcs 7" | 9.0 Search vendor "Siemens" for product "Simatic Pcs 7" and version "9.0" | - |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Pcs 7 Search vendor "Siemens" for product "Simatic Pcs 7" | 9.1 Search vendor "Siemens" for product "Simatic Pcs 7" and version "9.1" | - |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc" | < 7.4 Search vendor "Siemens" for product "Simatic Wincc" and version " < 7.4" | - |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc" | 7.4 Search vendor "Siemens" for product "Simatic Wincc" and version "7.4" | - |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc" | 7.4 Search vendor "Siemens" for product "Simatic Wincc" and version "7.4" | sp1 |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc" | 7.4 Search vendor "Siemens" for product "Simatic Wincc" and version "7.4" | sp1_update1 |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc" | 7.4 Search vendor "Siemens" for product "Simatic Wincc" and version "7.4" | sp1_update10 |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc" | 7.4 Search vendor "Siemens" for product "Simatic Wincc" and version "7.4" | sp1_update11 |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc" | 7.4 Search vendor "Siemens" for product "Simatic Wincc" and version "7.4" | sp1_update12 |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc" | 7.4 Search vendor "Siemens" for product "Simatic Wincc" and version "7.4" | sp1_update13 |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc" | 7.4 Search vendor "Siemens" for product "Simatic Wincc" and version "7.4" | sp1_update14 |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc" | 7.4 Search vendor "Siemens" for product "Simatic Wincc" and version "7.4" | sp1_update15 |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc" | 7.4 Search vendor "Siemens" for product "Simatic Wincc" and version "7.4" | sp1_update16 |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc" | 7.4 Search vendor "Siemens" for product "Simatic Wincc" and version "7.4" | sp1_update17 |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc" | 7.4 Search vendor "Siemens" for product "Simatic Wincc" and version "7.4" | sp1_update18 |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc" | 7.4 Search vendor "Siemens" for product "Simatic Wincc" and version "7.4" | sp1_update2 |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc" | 7.4 Search vendor "Siemens" for product "Simatic Wincc" and version "7.4" | sp1_update3 |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc" | 7.4 Search vendor "Siemens" for product "Simatic Wincc" and version "7.4" | sp1_update4 |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc" | 7.4 Search vendor "Siemens" for product "Simatic Wincc" and version "7.4" | sp1_update5 |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc" | 7.4 Search vendor "Siemens" for product "Simatic Wincc" and version "7.4" | sp1_update6 |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc" | 7.4 Search vendor "Siemens" for product "Simatic Wincc" and version "7.4" | sp1_update7 |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc" | 7.4 Search vendor "Siemens" for product "Simatic Wincc" and version "7.4" | sp1_update8 |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc" | 7.4 Search vendor "Siemens" for product "Simatic Wincc" and version "7.4" | sp1_update9 |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc" | 7.5 Search vendor "Siemens" for product "Simatic Wincc" and version "7.5" | - |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc" | 7.5 Search vendor "Siemens" for product "Simatic Wincc" and version "7.5" | sp1 |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc" | 7.5 Search vendor "Siemens" for product "Simatic Wincc" and version "7.5" | sp1_update1 |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc" | 7.5 Search vendor "Siemens" for product "Simatic Wincc" and version "7.5" | sp1_update2 |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc" | 7.5 Search vendor "Siemens" for product "Simatic Wincc" and version "7.5" | sp2 |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc" | 7.5 Search vendor "Siemens" for product "Simatic Wincc" and version "7.5" | sp2_update1 |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc" | 7.5 Search vendor "Siemens" for product "Simatic Wincc" and version "7.5" | sp2_update2 |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc" | 7.5 Search vendor "Siemens" for product "Simatic Wincc" and version "7.5" | sp2_update3 |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc" | 7.5 Search vendor "Siemens" for product "Simatic Wincc" and version "7.5" | sp2_update4 |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc" | 7.5 Search vendor "Siemens" for product "Simatic Wincc" and version "7.5" | sp2_update5 |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc" | 13 Search vendor "Siemens" for product "Simatic Wincc" and version "13" | - |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc" | 13 Search vendor "Siemens" for product "Simatic Wincc" and version "13" | sp1 |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc" | 13 Search vendor "Siemens" for product "Simatic Wincc" and version "13" | sp2 |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc" | 14.0.1 Search vendor "Siemens" for product "Simatic Wincc" and version "14.0.1" | - |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc" | 15 Search vendor "Siemens" for product "Simatic Wincc" and version "15" | - |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc" | 15.1 Search vendor "Siemens" for product "Simatic Wincc" and version "15.1" | - |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc" | 15.1 Search vendor "Siemens" for product "Simatic Wincc" and version "15.1" | update_1 |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc" | 15.1 Search vendor "Siemens" for product "Simatic Wincc" and version "15.1" | update_2 |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc" | 15.1 Search vendor "Siemens" for product "Simatic Wincc" and version "15.1" | update_3 |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc" | 15.1 Search vendor "Siemens" for product "Simatic Wincc" and version "15.1" | update_4 |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc" | 15.1 Search vendor "Siemens" for product "Simatic Wincc" and version "15.1" | update_5 |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc" | 15.1 Search vendor "Siemens" for product "Simatic Wincc" and version "15.1" | update_6 |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc" | 16 Search vendor "Siemens" for product "Simatic Wincc" and version "16" | - |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc" | 16 Search vendor "Siemens" for product "Simatic Wincc" and version "16" | update1 |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc" | 16 Search vendor "Siemens" for product "Simatic Wincc" and version "16" | update2 |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc" | 16 Search vendor "Siemens" for product "Simatic Wincc" and version "16" | update3 |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc" | 16 Search vendor "Siemens" for product "Simatic Wincc" and version "16" | update4 |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc" | 17 Search vendor "Siemens" for product "Simatic Wincc" and version "17" | - |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Simatic Wincc Search vendor "Siemens" for product "Simatic Wincc" | 17 Search vendor "Siemens" for product "Simatic Wincc" and version "17" | update1 |
Affected
| ||||||