Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cve[email protected]CVE-2021-31891
HistorySep 14, 2021 - 11:15 a.m.

CVE-2021-31891

2021-09-1411:15:24
CWE-78
[email protected]
web.nvd.nist.gov
27
cve-2021-31891
command injection
desigo cc
gma-manager
operation scheduler
siveillance control
siveillance control pro
security vulnerability

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

9.9 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

71.3%

JSON

A vulnerability has been identified in Desigo CC (All versions with OIS Extension Module), GMA-Manager (All versions with OIS running on Debian 9 or earlier), Operation Scheduler (All versions with OIS running on Debian 9 or earlier), Siveillance Control (All versions with OIS running on Debian 9 or earlier), Siveillance Control Pro (All versions). The affected application incorrectly neutralizes special elements in a specific HTTP GET request which could lead to command injection. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary code on the system with root privileges.

Affected configurations

NVD
Node
siemensdesigo_cc
OR
siemenssiveillance_control_pro
Node
siemensgma-manager
OR
siemensoperation_scheduler
OR
siemenssiveillance_control
AND
debiandebian_linuxRange≤9.0

CNA Affected

[
  {
    "product": "Desigo CC",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions with OIS Extension Module"
      }
    ]
  },
  {
    "product": "GMA-Manager",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions with OIS running on Debian 9 or earlier"
      }
    ]
  },
  {
    "product": "Operation Scheduler",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions with OIS running on Debian 9 or earlier"
      }
    ]
  },
  {
    "product": "Siveillance Control",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions with OIS running on Debian 9 or earlier"
      }
    ]
  },
  {
    "product": "Siveillance Control Pro",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  }
]

Related

cvelist 1
cnvd 1
nvd 1
prion 1
ics 1
cvelist
cvelist
CVE-2021-31891
2021-09-14 10:47:31
cnvd
cnvd
Siemens Siveillance OIS Operating System Command Injection Vulnerability
2021-09-15 00:00:00
nvd
nvd
CVE-2021-31891
2021-09-14 11:15:24
prion
prion
Command injection
2021-09-14 11:15:00
ics
ics
Siemens Siveillance OIS
2021-09-14 12:00:00

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

9.9 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

71.3%

JSON
Related for CVE-2021-31891
cvelist1cnvd1nvd1prion1ics1