Lucene search

[email protected]CVE-2021-27395

HistoryOct 12, 2021 - 10:15 a.m.

CVE-2021-27395

2021-10-1210:15:11

CWE-306

[email protected]

web.nvd.nist.gov

simatic process historian

vulnerability

authentication

data manipulation

nvd

cve-2021-27395

5.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:P/A:P

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

7.8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

35.1%

JSON

A vulnerability has been identified in SIMATIC Process Historian 2013 and earlier (All versions), SIMATIC Process Historian 2014 (All versions < SP3 Update 6), SIMATIC Process Historian 2019 (All versions), SIMATIC Process Historian 2020 (All versions). An interface in the software that is used for critical functionalities lacks authentication, which could allow a malicious user to maliciously insert, modify or delete data.

Affected configurations

NVD

Node

siemenssimatic_process_historian_2013

siemenssimatic_process_historian_2014Match-sp1

siemenssimatic_process_historian_2014Match-sp2

siemenssimatic_process_historian_2014Match-sp3

siemenssimatic_process_historian_2014Match-sp3_update4

siemenssimatic_process_historian_2019

siemenssimatic_process_historian_2020

CPENameOperatorVersion
siemens:simatic_process_historian_2013siemens simatic process historian 2013eq*
siemens:simatic_process_historian_2014siemens simatic process historian 2014eq-
siemens:simatic_process_historian_2019siemens simatic process historian 2019eq*
siemens:simatic_process_historian_2020siemens simatic process historian 2020eq*

CPE	Name	Operator	Version
siemens:simatic_process_historian_2013	siemens simatic process historian 2013	eq	*
siemens:simatic_process_historian_2014	siemens simatic process historian 2014	eq	-
siemens:simatic_process_historian_2019	siemens simatic process historian 2019	eq	*
siemens:simatic_process_historian_2020	siemens simatic process historian 2020	eq	*

CNA Affected

[
  {
    "product": "SIMATIC Process Historian 2013 and earlier",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  },
  {
    "product": "SIMATIC Process Historian 2014",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions < SP3 Update 6"
      }
    ]
  },
  {
    "product": "SIMATIC Process Historian 2019",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  },
  {
    "product": "SIMATIC Process Historian 2020",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  }
]

References

cert-portal.siemens.com/productcert/pdf/ssa-766247.pdf

5.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:P/A:P

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

7.8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

35.1%

JSON

Related for CVE-2021-27395

cvelist1 nvd1 ics1 cnvd1 prion1