PT-2021-21548 · Siemens · Tia Portal+1

Published 2021-08-10 · Updated 2022-07-01 · CVE-2021-37172

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions SIMATIC S7-1200 CPU family (incl. SIPLUS variants) version 4.5.0

Description A vulnerability has been identified where affected devices fail to authenticate against configured passwords when provisioned using TIA Portal V13. This could allow an attacker using TIA Portal V13 or later versions to bypass authentication and download arbitrary programs to the PLC.

Recommendations For SIMATIC S7-1200 CPU family (incl. SIPLUS variants) version 4.5.0, ensure that the device is provisioned using TIA Portal V13 SP1 or any later version to prevent the vulnerability.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2021-37172

Affected Products

Simatic S7-1200 Cpu

Tia Portal

References · 4

• https://osv.dev/vulnerability/CVE-2021-37172 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-830194.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37172 · Security Note
• https://t.me/cibsecurity/27048 · Telegram Post