Vulnerability · Published Jun 15, 2021 · Assigned by siemens

CVE-2021-27388

Critical 9.8

In plain English

A critical-severity improper input validation in SINAMICS Medium Voltage Products, Remote Access. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities).

Severity (CVSS NVD)9.8Critical

Exploit odds (30 days)1.5%top 24.9% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

SINAMICS medium voltage routable products are affected by a vulnerability in the Sm@rtServer component for remote access that could allow an unauthenticated attacker to cause a denial-of-service condition, and/or execution of limited configuration modifications and/or execution of limited control commands on the SINAMICS Medium Voltage Products, Remote Access (SINAMICS SL150: All versions, SINAMICS SM150: All versions, SINAMICS SM150i: All versions).

Affected products (as reported)

Vendor	Product	Versions
n/a	SINAMICS Medium Voltage Products, Remote Access	SINAMICS SL150: All versions, SINAMICS SM150: All versions, SINAMICS SM150i: All versions

Weakness: CWE-20

References

https://us-cert.cisa.gov/ics/advisories/icsa-21-131-04 x_refsource_MISC