Siemens SIMATIC WinCC (Update E)
Multiple vulnerabilities were found in SIMATIC WinCC that ultimately could allow local or remote attackers to escalate privileges and read, write or delete critical files. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available. Note: The vulnerability CVE-2021-40359 is part of a shared component, used by various Siemens products (SIMATIC Communication Services - SCS). The installation of a fix version of any product also removes the vulnerability for other products on the same system, even if those products were not updated.
beschreibt (3)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2021-40364US | low2.1 | — | ||
A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC04), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMATIC W… | ||||
| CVE-2021-40359US | medium5.0 | — | ||
A vulnerability has been identified in OpenPCS 7 V8.2 (All versions), OpenPCS 7 V9.0 (All versions < V9.0 Upd4), OpenPCS 7 V9.1 (All versions), SIMATIC BATCH V8.2 (All versions), S… | ||||
| CVE-2021-40358US | high7.5 | — | ||
A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC04), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMATIC W… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- SSA-840188: Multiple Vulnerabilities in SIMATIC WinCC Affecting Other SIMATIC Software Products - CSAF Versionself
- SSA-840188: Multiple Vulnerabilities in SIMATIC WinCC Affecting Other SIMATIC Software Products - HTML Versionself
- SSA-840188: Multiple Vulnerabilities in SIMATIC WinCC Affecting Other SIMATIC Software Products - PDF Versionself
- SSA-840188: Multiple Vulnerabilities in SIMATIC WinCC Affecting Other SIMATIC Software Products - TXT Versionself
- ICS Advisory ICSA-21-315-03 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-21-315-03 - Web Versionself
- Recommended Practicesexternal
Behebungen (60)
- MitigationOpenPCS 7 V8.2
The vulnerability is fixed if SIMATIC WinCC V7.4 SP1 Update 19 or later version is installed on the same system
- MitigationSIMATIC BATCH V8.2
The vulnerability is fixed if SIMATIC WinCC V7.4 SP1 Update 19 or later version is installed on the same system
- MitigationSIMATIC BATCH V9.0
The vulnerability is fixed if SIMATIC WinCC V7.4 SP1 Update 19 or later version is installed on the same system
- MitigationSIMATIC PCS 7 V8.2
CVE-2021-40358: Disable the webserver or only enable it temporarily, when needed
- MitigationSIMATIC PCS 7 V8.2
CVE-2021-40364: Harden the application’s host to prevent local access by untrusted personnel
- MitigationSIMATIC PCS 7 V8.2
To fix CVE-2021-40359 see chapter "Additional Information"
- MitigationSIMATIC PCS 7 V9.0
CVE-2021-40358: Disable the webserver or only enable it temporarily, when needed
- MitigationSIMATIC PCS 7 V9.0
CVE-2021-40364: Harden the application’s host to prevent local access by untrusted personnel
- MitigationSIMATIC PCS 7 V9.0
To fix CVE-2021-40359 see chapter "Additional Information"
- MitigationSIMATIC PCS 7 V9.1
CVE-2021-40358: Disable the webserver or only enable it temporarily, when needed
- MitigationSIMATIC PCS 7 V9.1
CVE-2021-40364: Harden the application’s host to prevent local access by untrusted personnel
- MitigationSIMATIC Route Control V8.2
The vulnerability is fixed if SIMATIC WinCC V7.4 SP1 Update 19 or later version is installed on the same system
- MitigationSIMATIC Route Control V9.0
The vulnerability is fixed if SIMATIC WinCC V7.4 SP1 Update 19 or later version is installed on the same system
- MitigationSIMATIC WinCC V15 and earlier
CVE-2021-40358: Disable the webserver or only enable it temporarily, when needed
- MitigationSIMATIC WinCC V15 and earlier
CVE-2021-40364: Harden the application’s host to prevent local access by untrusted personnel
- MitigationSIMATIC WinCC V16
CVE-2021-40358: Disable the webserver or only enable it temporarily, when needed
- MitigationSIMATIC WinCC V16
CVE-2021-40364: Harden the application’s host to prevent local access by untrusted personnel
- MitigationSIMATIC WinCC V17
CVE-2021-40358: Disable the webserver or only enable it temporarily, when needed
- MitigationSIMATIC WinCC V17
CVE-2021-40364: Harden the application’s host to prevent local access by untrusted personnel
- MitigationSIMATIC WinCC V7.4
CVE-2021-40358: Disable the webserver or only enable it temporarily, when needed
- MitigationSIMATIC WinCC V7.4
CVE-2021-40364: Harden the application’s host to prevent local access by untrusted personnel
- MitigationSIMATIC WinCC V7.5
CVE-2021-40358: Disable the webserver or only enable it temporarily, when needed
- MitigationSIMATIC WinCC V7.5
CVE-2021-40364: Harden the application’s host to prevent local access by untrusted personnel
- Kein Fix geplantOpenPCS 7 V8.2
Currently no fix is planned
- Kein Fix geplantSIMATIC BATCH V8.2
Currently no fix is planned
- Kein Fix geplantSIMATIC BATCH V9.0
Currently no fix is planned
- Kein Fix geplantSIMATIC NET PC Software V14
Currently no fix is planned
- Kein Fix geplantSIMATIC NET PC Software V15
Currently no fix is planned
- Kein Fix geplantSIMATIC Route Control V8.2
Currently no fix is planned
- Kein Fix geplantSIMATIC Route Control V9.0
Currently no fix is planned
- BehobenOpenPCS 7 V9.0
Update to V9.0 Upd4 or later version; V9.0 Upd4 is bundled in PCS 7 V9.0 SP3 UC04
https://support.industry.siemens.com/cs/ww/en/view/109780528/ - BehobenOpenPCS 7 V9.1
See remediation for SIMATIC PCS 7 V9.1
- BehobenSIMATIC BATCH V9.1
See remediation for SIMATIC PCS 7 V9.1
- BehobenSIMATIC NET PC Software V16
Update to V16 Update 6 or later version
https://support.industry.siemens.com/cs/ww/en/view/109811815/ - BehobenSIMATIC NET PC Software V17
Update to V17 SP1 or later version
https://support.industry.siemens.com/cs/ww/de/view/109808270/ - BehobenSIMATIC PCS 7 V8.2
Update to V8.2 SP1; then update SIMATIC WinCC to V7.4 SP1 Update 19 or later version to fix CVE-2021-40358 and CVE-2021-40364
https://support.industry.siemens.com/cs/ww/en/view/109806846/ - BehobenSIMATIC PCS 7 V8.2
Update to V8.2 SP1; then update SIMATIC WinCC to V7.4 SP1 Update 19 or later version to fix CVE-2021-40358 and CVE-2021-40364
https://support.industry.siemens.com/cs/ww/en/view/109806846/ - BehobenSIMATIC PCS 7 V8.2
Update to V8.2 SP1; then update SIMATIC WinCC to V7.4 SP1 Update 19 or later version to fix CVE-2021-40358 and CVE-2021-40364
https://support.industry.siemens.com/cs/ww/en/view/109806846/ - BehobenSIMATIC PCS 7 V9.0
Update to V9.0 SP3 UC04 or later version to fix CVE-2021-40358 and CVE-2021-40364
https://support.industry.siemens.com/cs/ww/en/view/109780528/ - BehobenSIMATIC PCS 7 V9.0
Update to V9.0 SP3 UC04 or later version to fix CVE-2021-40358 and CVE-2021-40364
https://support.industry.siemens.com/cs/ww/en/view/109780528/ - BehobenSIMATIC PCS 7 V9.0
Update to V9.0 SP3 UC04 or later version to fix CVE-2021-40358 and CVE-2021-40364
https://support.industry.siemens.com/cs/ww/en/view/109780528/ - BehobenSIMATIC PCS 7 V9.1
Update to V9.1 SP1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109805073/ - BehobenSIMATIC PCS 7 V9.1
Update to V9.1 SP1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109805073/ - BehobenSIMATIC PCS 7 V9.1
Update to V9.1 SP1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109805073/ - BehobenSIMATIC Route Control V9.1
See remediation for SIMATIC PCS 7 V9.1
- BehobenSIMATIC WinCC V15 and earlier
Update to V15 SP1 Update 7 or later version
https://support.industry.siemens.com/cs/us/en/view/109763890/ - BehobenSIMATIC WinCC V15 and earlier
Update to V15 SP1 Update 7 or later version
https://support.industry.siemens.com/cs/us/en/view/109763890/ - BehobenSIMATIC WinCC V15 and earlier
Update to V15 SP1 Update 7 or later version
https://support.industry.siemens.com/cs/us/en/view/109763890/ - BehobenSIMATIC WinCC V16
Update to V16 Update 5 or later version
https://support.industry.siemens.com/cs/ww/en/view/109776017/ - BehobenSIMATIC WinCC V16
Update to V16 Update 5 or later version
https://support.industry.siemens.com/cs/ww/en/view/109776017/ - BehobenSIMATIC WinCC V16
Update to V16 Update 5 or later version
https://support.industry.siemens.com/cs/ww/en/view/109776017/ - BehobenSIMATIC WinCC V17
Update to V17 Update 2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109784441/ - BehobenSIMATIC WinCC V17
Update to V17 Update 2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109784441/ - BehobenSIMATIC WinCC V17
Update to V17 Update 2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109784441/ - BehobenSIMATIC WinCC V7.4
Update to V7.4 SP1 Update 19 or later version
https://support.industry.siemens.com/cs/ww/en/view/109806846/ - BehobenSIMATIC WinCC V7.4
Update to V7.4 SP1 Update 19 or later version
https://support.industry.siemens.com/cs/ww/en/view/109806846/ - BehobenSIMATIC WinCC V7.4
Update to V7.4 SP1 Update 19 or later version
https://support.industry.siemens.com/cs/ww/en/view/109806846/ - BehobenSIMATIC WinCC V7.5
Update to V7.5 SP2 Update 5 or later version
https://support.industry.siemens.com/cs/ww/en/view/109793460/ - BehobenSIMATIC WinCC V7.5
Update to V7.5 SP2 Update 5 or later version
https://support.industry.siemens.com/cs/ww/en/view/109793460/ - BehobenSIMATIC WinCC V7.5
Update to V7.5 SP2 Update 5 or later version
https://support.industry.siemens.com/cs/ww/en/view/109793460/
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan