Log in Start free

Vulnerability · Published Apr 12, 2022 · Assigned by siemens

CVE-2021-42029

High 7.8

In plain English

A high-severity improper access control in SIMATIC STEP 7 (TIA Portal) V15 from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS NVD)7.8High
Exploit odds (30 days)0.2%top 84.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) V15 (All versions), SIMATIC STEP 7 (TIA Portal) V16 (All versions < V16 Update 5), SIMATIC STEP 7 (TIA Portal) V17 (All versions < V17 Update 2). An attacker could achieve privilege escalation on the web server of certain devices due to improper access control vulnerability in the engineering system software. The attacker needs to have direct access to the impacted web server.

Affected products (as reported)

VendorProductVersions
Siemens SIMATIC STEP 7 (TIA Portal) V15 All versions
Siemens SIMATIC STEP 7 (TIA Portal) V16 All versions < V16 Update 5
Siemens SIMATIC STEP 7 (TIA Portal) V17 All versions < V17 Update 2

Weakness: CWE-284

References