Vulnerability · Published Nov 9, 2021 · Assigned by siemens
CVE-2021-37207
High 7.8
In plain English
A high-severity incorrect permission assignment in SENTRON powermanager V3 from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).
Severity (CVSS NVD)7.8High
Exploit odds (30 days)0.2%top 87.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A vulnerability has been identified in SENTRON powermanager V3 (All versions). The affected application assigns improper access rights to a specific folder containing configuration files. This could allow an authenticated local attacker to inject arbitrary code and escalate privileges.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Siemens | SENTRON powermanager V3 | All versions |
Weakness: CWE-732
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-537983.pdf x_refsource_MISC