PT-2021-21560 · Unknown · Industrial Edge Management

Published 2021-09-14 · Updated 2021-09-24 · CVE-2021-37184

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Industrial Edge Management versions prior to V1.3

Description A vulnerability has been identified that allows an unauthenticated attacker to change the password of any user in the system under certain circumstances, potentially enabling the attacker to impersonate any valid user on an affected system.

Recommendations For versions prior to V1.3, update to version V1.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the system and monitoring for suspicious activity until the update can be applied.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2021-37184

Affected Products

Industrial Edge Management

References · 3

• https://cert-portal.siemens.com/productcert/pdf/ssa-692317.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-37184 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37184 · Security Note