Lucene search

[email protected]CVE-2021-40142

HistoryAug 27, 2021 - 7:15 a.m.

CVE-2021-40142

2021-08-2707:15:00

CWE-119

[email protected]

web.nvd.nist.gov

cve-2021-40142

opc foundation

local discovery server

denial of service

dos

memory location access

buffer overflow

vulnerability

nvd

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.004 Low

EPSS

Percentile

74.1%

JSON

In OPC Foundation Local Discovery Server (LDS) before 1.04.402.463, remote attackers can cause a denial of service (DoS) by sending carefully crafted messages that lead to Access of a Memory Location After the End of a Buffer.

CPENameOperatorVersion
opcfoundation:local_discover_serveropcfoundation local discover serverlt1.04.402.463
siemens:simatic_process_historian_opc_ua_server_firmwaresiemens simatic process historian opc ua server firmwarelt2022
siemens:simatic_wincc_runtimesiemens simatic wincc runtimeeq-
siemens:simatic_winccsiemens simatic wincceq-
siemens:simatic_net_pcsiemens simatic net pceq16
siemens:simatic_net_pcsiemens simatic net pceq15
siemens:simatic_net_pcsiemens simatic net pceq14
siemens:telecontrol_server_basicsiemens telecontrol server basiceq3.0
siemens:simatic_net_pcsiemens simatic net pceq17
siemens:simatic_wincc_unified_scada_runtimesiemens simatic wincc unified scada runtimeeq-

CPE	Name	Operator	Version
opcfoundation:local_discover_server	opcfoundation local discover server	lt	1.04.402.463
siemens:simatic_process_historian_opc_ua_server_firmware	siemens simatic process historian opc ua server firmware	lt	2022
siemens:simatic_wincc_runtime	siemens simatic wincc runtime	eq	-
siemens:simatic_wincc	siemens simatic wincc	eq	-
siemens:simatic_net_pc	siemens simatic net pc	eq	16
siemens:simatic_net_pc	siemens simatic net pc	eq	15
siemens:simatic_net_pc	siemens simatic net pc	eq	14
siemens:telecontrol_server_basic	siemens telecontrol server basic	eq	3.0
siemens:simatic_net_pc	siemens simatic net pc	eq	17
siemens:simatic_wincc_unified_scada_runtime	siemens simatic wincc unified scada runtime	eq	-

References

cert-portal.siemens.com/productcert/pdf/ssa-321292.pdf

files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2021-40142.pdf

opcfoundation.org/security-bulletins/

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.004 Low

EPSS

Percentile

74.1%

JSON

Related for CVE-2021-40142

ics1 prion1 cvelist1