Log in Start free

Vulnerability · Published Jan 11, 2022 · Assigned by siemens

CVE-2021-45033

High 8.8

In plain English

A high-severity hard-coded credentials in CP-8000 MASTER MODULE WITH I/O -25/+70°C from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities).

Severity (CVSS NVD)8.8High
Exploit odds (30 days)0.9%top 39.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions < V16.20), CP-8000 MASTER MODULE WITH I/O -40/+70°C (All versions < V16.20), CP-8021 MASTER MODULE (All versions < V16.20), CP-8022 MASTER MODULE WITH GPRS (All versions < V16.20). An undocumented debug port uses hard-coded default credentials. If this port is enabled by a privileged user, an attacker aware of the credentials could access an administrative debug shell on the affected device.

Affected products (as reported)

VendorProductVersions
Siemens CP-8000 MASTER MODULE WITH I/O -25/+70°C All versions < V16.20
Siemens CP-8000 MASTER MODULE WITH I/O -40/+70°C All versions < V16.20
Siemens CP-8021 MASTER MODULE All versions < V16.20
Siemens CP-8022 MASTER MODULE WITH GPRS All versions < V16.20

Weakness: CWE-798

References