Lucene search

[email protected]CVE-2021-27384

HistoryMay 12, 2021 - 2:15 p.m.

CVE-2021-27384

2021-05-1214:15:11

CWE-788

[email protected]

web.nvd.nist.gov

cve-2021-27384

smartvnc

out-of-bounds memory access

vulnerability

simatic hmi

siplus

simatic wincc runtime

sinamics

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 High

AI Score

Confidence

High

0.006 Low

EPSS

Percentile

79.4%

JSON

A vulnerability has been identified in SIMATIC HMI Comfort Outdoor Panels V15 7" & 15" (incl. SIPLUS variants) (All versions < V15.1 Update 6), SIMATIC HMI Comfort Outdoor Panels V16 7" & 15" (incl. SIPLUS variants) (All versions < V16 Update 4), SIMATIC HMI Comfort Panels V15 4" - 22" (incl. SIPLUS variants) (All versions < V15.1 Update 6), SIMATIC HMI Comfort Panels V16 4" - 22" (incl. SIPLUS variants) (All versions < V16 Update 4), SIMATIC HMI KTP Mobile Panels V15 KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions < V15.1 Update 6), SIMATIC HMI KTP Mobile Panels V16 KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions < V16 Update 4), SIMATIC WinCC Runtime Advanced V15 (All versions < V15.1 Update 6), SIMATIC WinCC Runtime Advanced V16 (All versions < V16 Update 4), SINAMICS GH150 (All versions), SINAMICS GL150 (with option X30) (All versions), SINAMICS GM150 (with option X30) (All versions), SINAMICS SH150 (All versions), SINAMICS SL150 (All versions), SINAMICS SM120 (All versions), SINAMICS SM150 (All versions), SINAMICS SM150i (All versions). SmartVNC has an out-of-bounds memory access vulnerability in the device layout handler, represented by a binary data stream on client side, which can potentially result in code execution.

Affected configurations

NVD

Node

siemenssimatic_wincc_runtime_advancedRange<16

siemenssimatic_wincc_runtime_advancedMatch16-

siemenssimatic_wincc_runtime_advancedMatch16update1

siemenssimatic_wincc_runtime_advancedMatch16update2

siemenssimatic_wincc_runtime_advancedMatch16update3

Node

siemenssinamics_sh150_firmware

AND

siemenssinamics_sh150Match-

Node

siemenssinamics_sm150i_firmware

AND

siemenssinamics_sm150iMatch-

Node

siemenssinamics_gh150_firmware

AND

siemenssinamics_gh150Match-

Node

siemenssinamics_gl150_firmware

AND

siemenssinamics_gl150Match-

Node

siemenssinamics_gm150_firmware

AND

siemenssinamics_gm150Match-

Node

siemenssinamics_sl150_firmware

AND

siemenssinamics_sl150Match-

Node

siemenssinamics_sm120_firmware

AND

siemenssinamics_sm120Match-

Node

siemenssinamics_sm150_firmware

AND

siemenssinamics_sm150Match-

Node

siemenssimatic_hmi_comfort_outdoor_panels_7\"_firmwareRange<16

siemenssimatic_hmi_comfort_outdoor_panels_7\"_firmwareMatch16-

siemenssimatic_hmi_comfort_outdoor_panels_7\"_firmwareMatch16update1

siemenssimatic_hmi_comfort_outdoor_panels_7\"_firmwareMatch16update2

siemenssimatic_hmi_comfort_outdoor_panels_7\"_firmwareMatch16update3

AND

siemenssimatic_hmi_comfort_outdoor_panels_7\"Match-

Node

siemenssimatic_hmi_comfort_outdoor_panels_15\"_firmwareRange<16

siemenssimatic_hmi_comfort_outdoor_panels_15\"_firmwareMatch16

siemenssimatic_hmi_comfort_outdoor_panels_15\"_firmwareMatch16-

siemenssimatic_hmi_comfort_outdoor_panels_15\"_firmwareMatch16update1

siemenssimatic_hmi_comfort_outdoor_panels_15\"_firmwareMatch16update2

siemenssimatic_hmi_comfort_outdoor_panels_15\"_firmwareMatch16update3

AND

siemenssimatic_hmi_comfort_outdoor_panels_15\"Match-

Node

siemenssimatic_hmi_comfort_panels_4\"_firmwareRange<16

siemenssimatic_hmi_comfort_panels_4\"_firmwareMatch16-

siemenssimatic_hmi_comfort_panels_4\"_firmwareMatch16update1

siemenssimatic_hmi_comfort_panels_4\"_firmwareMatch16update2

siemenssimatic_hmi_comfort_panels_4\"_firmwareMatch16update3

AND

siemenssimatic_hmi_comfort_panels_4\"Match-

Node

siemenssimatic_hmi_comfort_panels_22\"_firmwareRange<16

siemenssimatic_hmi_comfort_panels_22\"_firmwareMatch16-

siemenssimatic_hmi_comfort_panels_22\"_firmwareMatch16update1

siemenssimatic_hmi_comfort_panels_22\"_firmwareMatch16update2

siemenssimatic_hmi_comfort_panels_22\"_firmwareMatch16update3

AND

siemenssimatic_hmi_comfort_panels_22\"Match-

Node

siemenssimatic_hmi_ktp_mobile_panels_ktp400f_firmwareRange<16

siemenssimatic_hmi_ktp_mobile_panels_ktp400f_firmwareMatch16-

siemenssimatic_hmi_ktp_mobile_panels_ktp400f_firmwareMatch16update1

siemenssimatic_hmi_ktp_mobile_panels_ktp400f_firmwareMatch16update2

siemenssimatic_hmi_ktp_mobile_panels_ktp400f_firmwareMatch16update3

AND

siemenssimatic_hmi_ktp_mobile_panels_ktp400fMatch-

Node

siemenssimatic_hmi_ktp_mobile_panels_ktp700_firmwareRange<16

siemenssimatic_hmi_ktp_mobile_panels_ktp700_firmwareMatch16-

siemenssimatic_hmi_ktp_mobile_panels_ktp700_firmwareMatch16update1

siemenssimatic_hmi_ktp_mobile_panels_ktp700_firmwareMatch16update2

siemenssimatic_hmi_ktp_mobile_panels_ktp700_firmwareMatch16update3

AND

siemenssimatic_hmi_ktp_mobile_panels_ktp700Match-

Node

siemenssimatic_hmi_ktp_mobile_panels_ktp700f_firmwareRange<16

siemenssimatic_hmi_ktp_mobile_panels_ktp700f_firmwareMatch16-

siemenssimatic_hmi_ktp_mobile_panels_ktp700f_firmwareMatch16update1

siemenssimatic_hmi_ktp_mobile_panels_ktp700f_firmwareMatch16update2

siemenssimatic_hmi_ktp_mobile_panels_ktp700f_firmwareMatch16update3

AND

siemenssimatic_hmi_ktp_mobile_panels_ktp700fMatch-

Node

siemenssimatic_hmi_ktp_mobile_panels_ktp900_firmwareRange<16

siemenssimatic_hmi_ktp_mobile_panels_ktp900_firmwareMatch16-

siemenssimatic_hmi_ktp_mobile_panels_ktp900_firmwareMatch16update1

siemenssimatic_hmi_ktp_mobile_panels_ktp900_firmwareMatch16update2

siemenssimatic_hmi_ktp_mobile_panels_ktp900_firmwareMatch16update3

AND

siemenssimatic_hmi_ktp_mobile_panels_ktp900Match-

Node

siemenssimatic_hmi_ktp_mobile_panels_ktp900f_firmwareRange<16

siemenssimatic_hmi_ktp_mobile_panels_ktp900f_firmwareMatch16-

siemenssimatic_hmi_ktp_mobile_panels_ktp900f_firmwareMatch16update1

siemenssimatic_hmi_ktp_mobile_panels_ktp900f_firmwareMatch16update2

siemenssimatic_hmi_ktp_mobile_panels_ktp900f_firmwareMatch16update3

AND

siemenssimatic_hmi_ktp_mobile_panels_ktp900fMatch-

Node

siemenssimatic_hmi_comfort_outdoor_panels_7\"_firmwareRange<15.1

siemenssimatic_hmi_comfort_outdoor_panels_7\"_firmwareMatch15.1-

siemenssimatic_hmi_comfort_outdoor_panels_7\"_firmwareMatch15.1update1

siemenssimatic_hmi_comfort_outdoor_panels_7\"_firmwareMatch15.1update2

siemenssimatic_hmi_comfort_outdoor_panels_7\"_firmwareMatch15.1update3

siemenssimatic_hmi_comfort_outdoor_panels_7\"_firmwareMatch15.1update4

siemenssimatic_hmi_comfort_outdoor_panels_7\"_firmwareMatch15.1update5

AND

siemenssimatic_hmi_comfort_outdoor_panels_7\"Match-

Node

siemenssimatic_hmi_comfort_outdoor_panels_15\"_firmwareRange<15.1

siemenssimatic_hmi_comfort_outdoor_panels_15\"_firmwareMatch15.1-

siemenssimatic_hmi_comfort_outdoor_panels_15\"_firmwareMatch15.1update1

siemenssimatic_hmi_comfort_outdoor_panels_15\"_firmwareMatch15.1update2

siemenssimatic_hmi_comfort_outdoor_panels_15\"_firmwareMatch15.1update3

siemenssimatic_hmi_comfort_outdoor_panels_15\"_firmwareMatch15.1update4

siemenssimatic_hmi_comfort_outdoor_panels_15\"_firmwareMatch15.1update5

AND

siemenssimatic_hmi_comfort_outdoor_panels_15\"Match-

Node

siemenssimatic_hmi_comfort_panels_4\"_firmwareRange<15.1

siemenssimatic_hmi_comfort_panels_4\"_firmwareMatch15.1-

siemenssimatic_hmi_comfort_panels_4\"_firmwareMatch15.1update1

siemenssimatic_hmi_comfort_panels_4\"_firmwareMatch15.1update2

siemenssimatic_hmi_comfort_panels_4\"_firmwareMatch15.1update3

siemenssimatic_hmi_comfort_panels_4\"_firmwareMatch15.1update4

siemenssimatic_hmi_comfort_panels_4\"_firmwareMatch15.1update5

AND

siemenssimatic_hmi_comfort_panels_4\"Match-

Node

siemenssimatic_hmi_comfort_panels_22\"_firmwareRange<15.1

siemenssimatic_hmi_comfort_panels_22\"_firmwareMatch15.1-

siemenssimatic_hmi_comfort_panels_22\"_firmwareMatch15.1update1

siemenssimatic_hmi_comfort_panels_22\"_firmwareMatch15.1update2

siemenssimatic_hmi_comfort_panels_22\"_firmwareMatch15.1update3

siemenssimatic_hmi_comfort_panels_22\"_firmwareMatch15.1update4

siemenssimatic_hmi_comfort_panels_22\"_firmwareMatch15.1update5

AND

siemenssimatic_hmi_comfort_panels_22\"Match-

Node

siemenssimatic_hmi_ktp_mobile_panels_ktp400f_firmwareRange<15.1

siemenssimatic_hmi_ktp_mobile_panels_ktp400f_firmwareMatch15.1-

siemenssimatic_hmi_ktp_mobile_panels_ktp400f_firmwareMatch15.1update1

siemenssimatic_hmi_ktp_mobile_panels_ktp400f_firmwareMatch15.1update2

siemenssimatic_hmi_ktp_mobile_panels_ktp400f_firmwareMatch15.1update3

siemenssimatic_hmi_ktp_mobile_panels_ktp400f_firmwareMatch15.1update4

siemenssimatic_hmi_ktp_mobile_panels_ktp400f_firmwareMatch15.1update5

AND

siemenssimatic_hmi_ktp_mobile_panels_ktp400fMatch-

Node

siemenssimatic_hmi_ktp_mobile_panels_ktp700_firmwareRange<15.1

siemenssimatic_hmi_ktp_mobile_panels_ktp700_firmwareMatch15.1-

siemenssimatic_hmi_ktp_mobile_panels_ktp700_firmwareMatch15.1update1

siemenssimatic_hmi_ktp_mobile_panels_ktp700_firmwareMatch15.1update2

siemenssimatic_hmi_ktp_mobile_panels_ktp700_firmwareMatch15.1update3

siemenssimatic_hmi_ktp_mobile_panels_ktp700_firmwareMatch15.1update4

siemenssimatic_hmi_ktp_mobile_panels_ktp700_firmwareMatch15.1update5

AND

siemenssimatic_hmi_ktp_mobile_panels_ktp700Match-

Node

siemenssimatic_hmi_ktp_mobile_panels_ktp700f_firmwareRange<15.1

siemenssimatic_hmi_ktp_mobile_panels_ktp700f_firmwareMatch15.1-

siemenssimatic_hmi_ktp_mobile_panels_ktp700f_firmwareMatch15.1update1

siemenssimatic_hmi_ktp_mobile_panels_ktp700f_firmwareMatch15.1update2

siemenssimatic_hmi_ktp_mobile_panels_ktp700f_firmwareMatch15.1update3

siemenssimatic_hmi_ktp_mobile_panels_ktp700f_firmwareMatch15.1update4

siemenssimatic_hmi_ktp_mobile_panels_ktp700f_firmwareMatch15.1update5

AND

siemenssimatic_hmi_ktp_mobile_panels_ktp700fMatch-

Node

siemenssimatic_hmi_ktp_mobile_panels_ktp900_firmwareRange<15.1

siemenssimatic_hmi_ktp_mobile_panels_ktp900_firmwareMatch15.1-

siemenssimatic_hmi_ktp_mobile_panels_ktp900_firmwareMatch15.1update1

siemenssimatic_hmi_ktp_mobile_panels_ktp900_firmwareMatch15.1update2

siemenssimatic_hmi_ktp_mobile_panels_ktp900_firmwareMatch15.1update3

siemenssimatic_hmi_ktp_mobile_panels_ktp900_firmwareMatch15.1update4

siemenssimatic_hmi_ktp_mobile_panels_ktp900_firmwareMatch15.1update5

AND

siemenssimatic_hmi_ktp_mobile_panels_ktp900Match-

Node

siemenssimatic_hmi_ktp_mobile_panels_ktp900f_firmwareRange<15.1

siemenssimatic_hmi_ktp_mobile_panels_ktp900f_firmwareMatch15.1-

siemenssimatic_hmi_ktp_mobile_panels_ktp900f_firmwareMatch15.1update1

siemenssimatic_hmi_ktp_mobile_panels_ktp900f_firmwareMatch15.1update2

siemenssimatic_hmi_ktp_mobile_panels_ktp900f_firmwareMatch15.1update3

siemenssimatic_hmi_ktp_mobile_panels_ktp900f_firmwareMatch15.1update4

siemenssimatic_hmi_ktp_mobile_panels_ktp900f_firmwareMatch15.1update5

AND

siemenssimatic_hmi_ktp_mobile_panels_ktp900fMatch-

Node

siemenssimatic_wincc_runtime_advancedRange<15.1

siemenssimatic_wincc_runtime_advancedMatch15.1-

siemenssimatic_wincc_runtime_advancedMatch15.1update1

siemenssimatic_wincc_runtime_advancedMatch15.1update2

siemenssimatic_wincc_runtime_advancedMatch15.1update3

siemenssimatic_wincc_runtime_advancedMatch15.1update4

siemenssimatic_wincc_runtime_advancedMatch15.1update5

CPENameOperatorVersion
siemens:simatic_wincc_runtime_advancedsiemens simatic wincc runtime advancedlt16

CPE	Name	Operator	Version
siemens:simatic_wincc_runtime_advanced	siemens simatic wincc runtime advanced	lt	16

CNA Affected

[
  {
    "product": "SIMATIC HMI Comfort Outdoor Panels V15 7\\\" & 15\\\" (incl. SIPLUS variants)",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions < V15.1 Update 6"
      }
    ]
  },
  {
    "product": "SIMATIC HMI Comfort Outdoor Panels V16 7\\\" & 15\\\" (incl. SIPLUS variants)\n",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions < V16 Update 4"
      }
    ]
  },
  {
    "product": "SIMATIC HMI Comfort Panels V15 4\\\" - 22\\\" (incl. SIPLUS variants)",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions < V15.1 Update 6"
      }
    ]
  },
  {
    "product": "SIMATIC HMI Comfort Panels V16 4\\\" - 22\\\" (incl. SIPLUS variants)\n",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions < V16 Update 4"
      }
    ]
  },
  {
    "product": "SIMATIC HMI KTP Mobile Panels V15 KTP400F, KTP700, KTP700F, KTP900 and KTP900F",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions < V15.1 Update 6"
      }
    ]
  },
  {
    "product": "SIMATIC HMI KTP Mobile Panels V16 KTP400F, KTP700, KTP700F, KTP900 and KTP900F\n",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions < V16 Update 4"
      }
    ]
  },
  {
    "product": "SIMATIC WinCC Runtime Advanced V15",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions < V15.1 Update 6"
      }
    ]
  },
  {
    "product": "SIMATIC WinCC Runtime Advanced V16",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions < V16 Update 4"
      }
    ]
  },
  {
    "product": "SINAMICS GH150",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  },
  {
    "product": "SINAMICS GL150 (with option X30)",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  },
  {
    "product": "SINAMICS GM150 (with option X30)",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  },
  {
    "product": "SINAMICS SH150",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  },
  {
    "product": "SINAMICS SL150",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  },
  {
    "product": "SINAMICS SM120",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  },
  {
    "product": "SINAMICS SM150",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  },
  {
    "product": "SINAMICS SM150i",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  }
]

References

cert-portal.siemens.com/productcert/pdf/ssa-286838.pdf

cert-portal.siemens.com/productcert/pdf/ssa-538778.pdf

us-cert.cisa.gov/ics/advisories/icsa-21-131-11

Social References

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 High

AI Score

Confidence

High

0.006 Low

EPSS

Percentile

79.4%

JSON

Related for CVE-2021-27384

prion1 cvelist1 nvd1 ics2