Vulnerability · Published Sep 14, 2021 · Assigned by siemens
CVE-2021-37184
Critical 9.8
In plain English
A critical-severity authorization bypass via user-controlled key in Industrial Edge Management from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities).
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)1.0%top 36.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A vulnerability has been identified in Industrial Edge Management (All versions < V1.3). An unauthenticated attacker could change the the password of any user in the system under certain circumstances. With this an attacker could impersonate any valid user on an affected system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Siemens | Industrial Edge Management | All versions < V1.3 |
Weakness: CWE-639
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-692317.pdf x_refsource_MISC