Lucene search

K
cve[email protected]CVE-2021-27395
HistoryOct 12, 2021 - 10:15 a.m.

CVE-2021-27395

2021-10-1210:15:11
CWE-306
web.nvd.nist.gov
21
simatic process historian
vulnerability
authentication
data manipulation
nvd
cve-2021-27395

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

7.8 High

AI Score

Confidence

High

5.5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:P/A:P

0.001 Low

EPSS

Percentile

35.0%

A vulnerability has been identified in SIMATIC Process Historian 2013 and earlier (All versions), SIMATIC Process Historian 2014 (All versions < SP3 Update 6), SIMATIC Process Historian 2019 (All versions), SIMATIC Process Historian 2020 (All versions). An interface in the software that is used for critical functionalities lacks authentication, which could allow a malicious user to maliciously insert, modify or delete data.

Affected configurations

NVD
Node
siemenssimatic_process_historian_2013
OR
siemenssimatic_process_historian_2014Match-sp1
OR
siemenssimatic_process_historian_2014Match-sp2
OR
siemenssimatic_process_historian_2014Match-sp3
OR
siemenssimatic_process_historian_2014Match-sp3_update4
OR
siemenssimatic_process_historian_2019
OR
siemenssimatic_process_historian_2020

CNA Affected

[
  {
    "product": "SIMATIC Process Historian 2013 and earlier",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  },
  {
    "product": "SIMATIC Process Historian 2014",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions < SP3 Update 6"
      }
    ]
  },
  {
    "product": "SIMATIC Process Historian 2019",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  },
  {
    "product": "SIMATIC Process Historian 2020",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  }
]

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

7.8 High

AI Score

Confidence

High

5.5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:P/A:P

0.001 Low

EPSS

Percentile

35.0%

Related for CVE-2021-27395