Vulnerability · Published Jun 28, 2021 · Assigned by siemens
CVE-2021-31337
Critical 9.8
In plain English
A critical-severity missing authentication in SINAMICS Medium Voltage Products. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities).
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)1.7%top 23.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The Telnet service of the SIMATIC HMI Comfort Panels system component in affected products does not require authentication, which may allow a remote attacker to gain access to the device if the service is enabled. Telnet is disabled by default on the SINAMICS Medium Voltage Products (SINAMICS SL150: All versions, SINAMICS SM150: All versions, SINAMICS SM150i: All versions).
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | SINAMICS Medium Voltage Products | SINAMICS SL150: All versions, SINAMICS SM150: All versions, SINAMICS SM150i: All versions |
Weakness: CWE-306
References
- https://us-cert.cisa.gov/ics/advisories/icsa-21-131-04 x_refsource_MISC