Lucene search

[email protected]CVE-2021-37181

HistorySep 14, 2021 - 11:15 a.m.

CVE-2021-37181

2021-09-1411:15:25

CWE-502

[email protected]

web.nvd.nist.gov

cerberus dms

desigo cc

vulnerability

arbitrary code execution

cve-2021-37181

nvd

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

9.5 High

AI Score

Confidence

High

0.006 Low

EPSS

Percentile

78.4%

JSON

A vulnerability has been identified in Cerberus DMS V4.0 (All versions), Cerberus DMS V4.1 (All versions), Cerberus DMS V4.2 (All versions), Cerberus DMS V5.0 (All versions < v5.0 QU1), Desigo CC Compact V4.0 (All versions), Desigo CC Compact V4.1 (All versions), Desigo CC Compact V4.2 (All versions), Desigo CC Compact V5.0 (All versions < V5.0 QU1), Desigo CC V4.0 (All versions), Desigo CC V4.1 (All versions), Desigo CC V4.2 (All versions), Desigo CC V5.0 (All versions < V5.0 QU1). The application deserialises untrusted data without sufficient validations, that could result in an arbitrary deserialization. This could allow an unauthenticated attacker to execute code in the affected system. The CCOM communication component used for Windows App / Click-Once and IE Web / XBAP client connectivity are affected by the vulnerability.

Affected configurations

NVD

Node

siemenscerberus_dmsMatch4.0

siemenscerberus_dmsMatch4.1

siemenscerberus_dmsMatch4.2

siemenscerberus_dmsMatch5.0-

siemensdesigo_ccMatch4.0

siemensdesigo_ccMatch4.1

siemensdesigo_ccMatch4.2

siemensdesigo_ccMatch5.0-

siemensdesigo_cc_compactMatch4.0

siemensdesigo_cc_compactMatch4.1

siemensdesigo_cc_compactMatch4.2

siemensdesigo_cc_compactMatch5.0-

CPENameOperatorVersion
siemens:cerberus_dmssiemens cerberus dmseq4.0
siemens:cerberus_dmssiemens cerberus dmseq4.1
siemens:cerberus_dmssiemens cerberus dmseq4.2
siemens:cerberus_dmssiemens cerberus dmseq5.0
siemens:desigo_ccsiemens desigo cceq4.0
siemens:desigo_ccsiemens desigo cceq4.1
siemens:desigo_ccsiemens desigo cceq4.2
siemens:desigo_ccsiemens desigo cceq5.0
siemens:desigo_cc_compactsiemens desigo cc compacteq4.0
siemens:desigo_cc_compactsiemens desigo cc compacteq4.1

CPE	Name	Operator	Version
siemens:cerberus_dms	siemens cerberus dms	eq	4.0
siemens:cerberus_dms	siemens cerberus dms	eq	4.1
siemens:cerberus_dms	siemens cerberus dms	eq	4.2
siemens:cerberus_dms	siemens cerberus dms	eq	5.0
siemens:desigo_cc	siemens desigo cc	eq	4.0
siemens:desigo_cc	siemens desigo cc	eq	4.1
siemens:desigo_cc	siemens desigo cc	eq	4.2
siemens:desigo_cc	siemens desigo cc	eq	5.0
siemens:desigo_cc_compact	siemens desigo cc compact	eq	4.0
siemens:desigo_cc_compact	siemens desigo cc compact	eq	4.1

Rows per page:

1-10 of 121

CNA Affected

[
  {
    "product": "Cerberus DMS V4.0",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  },
  {
    "product": "Cerberus DMS V4.1",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  },
  {
    "product": "Cerberus DMS V4.2",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  },
  {
    "product": "Cerberus DMS V5.0",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions < v5.0 QU1"
      }
    ]
  },
  {
    "product": "Desigo CC Compact V4.0",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  },
  {
    "product": "Desigo CC Compact V4.1",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  },
  {
    "product": "Desigo CC Compact V4.2",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  },
  {
    "product": "Desigo CC Compact V5.0",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions < V5.0 QU1"
      }
    ]
  },
  {
    "product": "Desigo CC V4.0",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  },
  {
    "product": "Desigo CC V4.1",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  },
  {
    "product": "Desigo CC V4.2",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  },
  {
    "product": "Desigo CC V5.0",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions < V5.0 QU1"
      }
    ]
  }
]

References

cert-portal.siemens.com/productcert/pdf/ssa-453715.pdf

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

9.5 High

AI Score

Confidence

High

0.006 Low

EPSS

Percentile

78.4%

JSON

Related for CVE-2021-37181

cnvd1 ics1 prion1 cvelist1 nvd1