CVE-2021-31894

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-31894
A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.X (All versions < V9.1 SP2), SIMATIC PDM (All versions < V9.2 SP2), SIMATIC STEP 7 V5.X (All versions < V5.7), SINAMICS STARTER (containing STEP 7 OEM version) (All versions < V5.4 SP2 HF1). A directory containing metafiles relevant to devices' configurations has write permissions. An attacker could leverage this vulnerability by changing the content of certain metafiles and subsequently manipulate parameters or behavior of devices that would be later configured by the affected software.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.0 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

7.2 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
https://cert-portal.siemens.com/productcert/pdf/ssa-661034.pdf Patch Vendor Advisory
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:o:siemens:simatic_pcs_7_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:siemens:simatic_pcs_7_firmware:9.0:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_pcs_7:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:siemens:simatic_pdm_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_pdm:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:siemens:simatic_step_7_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_step_7:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
OR cpe:2.3:o:siemens:sinamics_starter_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:siemens:sinamics_starter_firmware:5.4:-:*:*:*:*:*:*
cpe:2.3:o:siemens:sinamics_starter_firmware:5.4:hf1:*:*:*:*:*:*
cpe:2.3:o:siemens:sinamics_starter_firmware:5.4:hf2:*:*:*:*:*:*
cpe:2.3:o:siemens:sinamics_starter_firmware:5.4:sp1:*:*:*:*:*:*
cpe:2.3:o:siemens:sinamics_starter_firmware:5.4:sp1_hf1:*:*:*:*:*:*
cpe:2.3:o:siemens:sinamics_starter_firmware:5.4:sp2:*:*:*:*:*:*
cpe:2.3:h:siemens:sinamics_starter:-:*:*:*:*:*:*:*
History

10 Aug 2022, 20:15

Type Values Removed Values Added
Summary A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.X (All versions < V9.1 SP2), SIMATIC PDM (All versions < V9.2 SP2), SIMATIC STEP 7 V5.X (All versions < V5.7), SINAMICS STARTER (containing STEP 7 OEM version) (All versions < V5.4 SP2 HF1). A directory containing metafiles relevant to devices' configurations has write permissions. An attacker could leverage this vulnerability by changing the content of certain metafiles and subsequently manipulate parameters or behavior of devices that would be later configured by the affected software. A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.X (All versions < V9.1 SP2), SIMATIC PDM (All versions < V9.2 SP2), SIMATIC STEP 7 V5.X (All versions < V5.7), SINAMICS STARTER (containing STEP 7 OEM version) (All versions < V5.4 SP2 HF1). A directory containing metafiles relevant to devices' configurations has write permissions. An attacker could leverage this vulnerability by changing the content of certain metafiles and subsequently manipulate parameters or behavior of devices that would be later configured by the affected software.

10 Aug 2022, 12:15

Type Values Removed Values Added
Summary A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.X (All versions), SIMATIC PDM (All versions), SIMATIC STEP 7 V5.X (All versions < V5.7), SINAMICS STARTER (containing STEP 7 OEM version) (All versions < V5.4 SP2 HF1). A directory containing metafiles relevant to devices' configurations has write permissions. An attacker could leverage this vulnerability by changing the content of certain metafiles and subsequently manipulate parameters or behavior of devices that would be later configured by the affected software. A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.X (All versions < V9.1 SP2), SIMATIC PDM (All versions < V9.2 SP2), SIMATIC STEP 7 V5.X (All versions < V5.7), SINAMICS STARTER (containing STEP 7 OEM version) (All versions < V5.4 SP2 HF1). A directory containing metafiles relevant to devices' configurations has write permissions. An attacker could leverage this vulnerability by changing the content of certain metafiles and subsequently manipulate parameters or behavior of devices that would be later configured by the affected software.

01 Jul 2022, 18:12

Type Values Removed Values Added
CPE cpe:2.3:o:siemens:sinamics_starter_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:siemens:sinamics_starter_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:siemens:sinamics_starter_firmware:5.4:hf2:*:*:*:*:*:*
cpe:2.3:o:siemens:sinamics_starter_firmware:5.4:hf1:*:*:*:*:*:*
cpe:2.3:o:siemens:sinamics_starter_firmware:5.4:sp2:*:*:*:*:*:*
cpe:2.3:o:siemens:sinamics_starter_firmware:5.4:sp1:*:*:*:*:*:*
cpe:2.3:o:siemens:sinamics_starter_firmware:5.4:-:*:*:*:*:*:*
cpe:2.3:o:siemens:sinamics_starter_firmware:5.4:sp1_hf1:*:*:*:*:*:*
cpe:2.3:o:siemens:simatic_pcs_7_firmware:9.0:*:*:*:*:*:*:*

14 Sep 2021, 11:15

Type Values Removed Values Added
Summary A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.X (All versions), SIMATIC PDM (All versions), SIMATIC STEP 7 V5.X (All versions < V5.7), SINAMICS STARTER (containing STEP 7 OEM version) (All versions). A directory containing metafiles relevant to devices' configurations has write permissions. An attacker could leverage this vulnerability by changing the content of certain metafiles and subsequently manipulate parameters or behavior of devices that would be later configured by the affected software. A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.X (All versions), SIMATIC PDM (All versions), SIMATIC STEP 7 V5.X (All versions < V5.7), SINAMICS STARTER (containing STEP 7 OEM version) (All versions < V5.4 SP2 HF1). A directory containing metafiles relevant to devices' configurations has write permissions. An attacker could leverage this vulnerability by changing the content of certain metafiles and subsequently manipulate parameters or behavior of devices that would be later configured by the affected software.

06 Aug 2021, 13:57

Type Values Removed Values Added
References (CONFIRM) https://cert-portal.siemens.com/productcert/pdf/ssa-661034.pdf - (CONFIRM) https://cert-portal.siemens.com/productcert/pdf/ssa-661034.pdf - Patch, Vendor Advisory
CPE cpe:2.3:o:siemens:simatic_pdm_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_step_7:-:*:*:*:*:*:*:*
cpe:2.3:o:siemens:simatic_step_7_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_pcs_7:-:*:*:*:*:*:*:*
cpe:2.3:o:siemens:simatic_pcs_7_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:sinamics_starter:-:*:*:*:*:*:*:*
cpe:2.3:o:siemens:sinamics_starter_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_pdm:-:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : 7.2
v3 : 8.8

13 Jul 2021, 12:15

Type Values Removed Values Added
CWE CWE-732
Summary A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.X (All versions), SIMATIC PDM (All versions), SIMATIC STEP 7 V5.X (All versions < V5.7), SINAMICS STARTER (containing STEP 7 OEM version) (All versions). A directory containing metafiles relevant to devices' configurations has write permissions. An attacker could leverage this vulnerability by changing the content of certain metafiles and subsequently manipulate parameters or behavior of devices that would be later configured by the affected software. A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.X (All versions), SIMATIC PDM (All versions), SIMATIC STEP 7 V5.X (All versions < V5.7), SINAMICS STARTER (containing STEP 7 OEM version) (All versions). A directory containing metafiles relevant to devices' configurations has write permissions. An attacker could leverage this vulnerability by changing the content of certain metafiles and subsequently manipulate parameters or behavior of devices that would be later configured by the affected software.

13 Jul 2021, 11:31

Type Values Removed Values Added
New CVE
Information

Published : 2021-07-13 11:15

Updated : 2023-12-10 13:55

NVD link : CVE-2021-31894

Mitre link : CVE-2021-31894

CVE.ORG link : CVE-2021-31894

JSON object : View

Products Affected

siemens

  • simatic_pcs_7
  • sinamics_starter
  • simatic_pdm
  • simatic_pdm_firmware
  • simatic_step_7_firmware
  • sinamics_starter_firmware
  • simatic_pcs_7_firmware
  • simatic_step_7
CWE
CWE-732

Incorrect Permission Assignment for Critical Resource