CVE-2021-42022

CVE-2021-42022 affects Siemens SIMATIC eaSie PCS 7 Skill Package: all versions before 21.00 SP3 are vulnerable to path traversal during file downloads. The issue arises from improper neutralization of elements in the pathname, allowing an attacker to resolve the path outside the restricted direct...

Vulnerability fixed in SIMATIC eaSie PCS7

Siemens has fixed a vulnerability in SIMATIC eaSie PCS7. A authenticated malicious party can exploit the vulnerability to access arbitrary files via path-traversal on the vulnerable system. The download function in which the vulnerability is not activated by default. Siemens has released updates ...

Siemens SIMATIC eaSie PCS 7 Skill Package

1. EXECUTIVE SUMMARY CVSS v3 6.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: SIMATIC eaSie PCS 7 Skill Package Vulnerability: Path Traversal 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an authenticated remote attacker to read...