PT-2021-17434 · Siemens · Simatic Process Historian

Published 2021-10-12 · Updated 2021-10-19 · CVE-2021-27395

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions SIMATIC Process Historian versions prior to 2014 SP3 Update 6 SIMATIC Process Historian 2019 versions SIMATIC Process Historian 2020 versions

Description A vulnerability has been identified in the software where an interface used for critical functionalities lacks authentication. This could allow a malicious user to insert, modify, or delete data maliciously.

Recommendations For SIMATIC Process Historian versions prior to 2014 SP3 Update 6, update to SP3 Update 6 or later. For SIMATIC Process Historian 2019 versions, there is no information about a newer version that contains a fix for this vulnerability. For SIMATIC Process Historian 2020 versions, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2021-27395

Affected Products

Simatic Process Historian

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2021-27395 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-766247.pdf · Vendor Advisory
• https://t.me/cibsecurity/30391 · Telegram Post