PT-2021-21575 · Senron · Senron Powermanager V3

Published 2021-11-09 · Updated 2021-11-11 · CVE-2021-37207

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SENRON powermanager V3 (All versions)

Description A vulnerability has been identified where the affected application assigns improper access rights to a specific folder containing configuration files. This could allow an authenticated local attacker to inject arbitrary code and escalate privileges.

Recommendations For all versions of SENRON powermanager V3, consider restricting access to the configuration files folder to prevent arbitrary code injection and privilege escalation until a fix is available. As a temporary workaround, review and adjust the access rights of the specific folder to ensure only authorized access is allowed.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2021-37207

Affected Products

Senron Powermanager V3

References · 4

• https://osv.dev/vulnerability/CVE-2021-37207 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-537983.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37207 · Security Note
• https://t.me/cibsecurity/32041 · Telegram Post