PT-2021-19569 · Siemens · Simatic Pdm+3

Published 2021-07-13 · Updated 2022-08-10 · CVE-2021-31894

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: SIMATIC PCS 7 versions V8.2 and earlier SIMATIC PCS 7 versions prior to V9.1 SP2 SIMATIC PDM versions prior to V9.2 SP2 SIMATIC STEP 7 versions prior to V5.7 SINAMICS STARTER versions prior to V5.4 SP2 HF1

Description: A vulnerability has been identified where a directory containing metafiles relevant to devices' configurations has write permissions. An attacker could leverage this vulnerability by changing the content of certain metafiles and subsequently manipulate parameters or behavior of devices that would be later configured by the affected software.

Recommendations: For SIMATIC PCS 7 versions V8.2 and earlier, update to a version later than V8.2. For SIMATIC PCS 7 versions prior to V9.1 SP2, update to V9.1 SP2 or later. For SIMATIC PDM versions prior to V9.2 SP2, update to V9.2 SP2 or later. For SIMATIC STEP 7 versions prior to V5.7, update to V5.7 or later. For SINAMICS STARTER versions prior to V5.4 SP2 HF1, update to V5.4 SP2 HF1 or later.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2021-31894

Affected Products

Simatic Pcs 7

Simatic Pdm

Simatic Step 7

Sinamics Starter

References · 3

• https://cert-portal.siemens.com/productcert/pdf/ssa-661034.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-31894 · Security Note
• https://osv.dev/vulnerability/CVE-2021-31894 · Vendor Advisory