CVE-2021-31893

highPriorität · verfolgen · 31EPSS 0.006 · 47. PerzentilDEEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.56% (47th) EPSS

CVSS 7.2 · high

Is it mine?

26 products

Prüfe deine Angriffsfläche

Who says so?

5 sources

cnnvd · enisa_euvd · cisa_csaf_ot · nvd

EPSS · bewertet 2026-10-27

A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3), SIMATIC PDM (All versions < V9.2), SIMATIC STEP 7 V5.X (All versions < V5.6 SP2 HF3), SINAMICS STARTER (containing STEP 7 OEM version) (All versions < V5.4 HF2). The affected software contains a buffer overflow vulnerability while handling certain files that could allow a local attacker to trigger a denial-of-service condition or potentially lead to remote code execution.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

BehobenSIMATIC PCS 7 V9.0siemens_psirt
Update to V9.0 SP3 or later version
BehobenSIMATIC PDMsiemens_psirt
Update to V9.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794361/
BehobenSIMATIC STEP 7 V5.Xsiemens_psirt
Update to V5.6 SP2 HF3 or later version
https://support.industry.siemens.com/cs/de/en/view/109779992/
BehobenSINAMICS STARTER (containing STEP 7 OEM version)siemens_psirt
Update to V5.4 HF2 or later version
https://support.industry.siemens.com/cs/us/en/view/109782792/
BehobenSIMATIC PCS 7 V9.0cisa_csaf_ot
Update to V9.0 SP3 or later version
BehobenSIMATIC PDMcisa_csaf_ot
Update to V9.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794361/
BehobenSIMATIC STEP 7 V5.Xcisa_csaf_ot
Update to V5.6 SP2 HF3 or later version
https://support.industry.siemens.com/cs/de/en/view/109779992/
BehobenSINAMICS STARTER (containing STEP 7 OEM version)cisa_csaf_ot
Update to V5.4 HF2 or later version
https://support.industry.siemens.com/cs/us/en/view/109782792/
WorkaroundSIMATIC PCS 7 V8.2 and earliersiemens_psirt
Only use project files from trusted sources
WorkaroundSIMATIC PCS 7 V9.0siemens_psirt
Only use project files from trusted sources
WorkaroundSIMATIC PDMsiemens_psirt
Only use project files from trusted sources
WorkaroundSIMATIC STEP 7 V5.Xsiemens_psirt
Only use project files from trusted sources
WorkaroundSINAMICS STARTER (containing STEP 7 OEM version)siemens_psirt
Only use project files from trusted sources
WorkaroundSIMATIC PCS 7 V8.2 and earliercisa_csaf_ot
Only use project files from trusted sources
WorkaroundSIMATIC PCS 7 V9.0cisa_csaf_ot
Only use project files from trusted sources
WorkaroundSIMATIC PDMcisa_csaf_ot
Only use project files from trusted sources
WorkaroundSIMATIC STEP 7 V5.Xcisa_csaf_ot
Only use project files from trusted sources
WorkaroundSINAMICS STARTER (containing STEP 7 OEM version)cisa_csaf_ot
Only use project files from trusted sources
Kein Fix verfügbarSIMATIC PCS 7 V8.2 and earliersiemens_psirt
Currently no remediation is available
Kein Fix verfügbarSIMATIC PCS 7 V8.2 and earliercisa_csaf_ot
Currently no remediation is available

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

7.8

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v2.07.2highAV:L/AC:L/Au:N/C:C/I:C/A:Cprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 10

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 1.8 · Auswirkung 5.9

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:Csecondary · CISA US

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:Csecondary · Siemens ProductCERT DE

v3.17.1highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-120USCWE-120USCWE-120US

betroffene Produkte (26)

Betroffene Produkte und Versionsbereiche.

SIMATIC PCS 7 V8.2 and earlieralle Versionencisa_csaf_otUS
SIMATIC PCS 7 V9.0alle Versionencisa_csaf_otUS
SIMATIC PDMalle Versionencisa_csaf_otUS
SIMATIC STEP 7 V5.Xalle Versionencisa_csaf_otUS
SINAMICS STARTER (containing STEP 7 OEM version)alle Versionencisa_csaf_otUS
Siemens SIMATIC PCS 7 V8.2 and earlier≤ vers:all/*cisa_csaf_otUS
Siemens SIMATIC PCS 7 V9.0< V9.0_SP3cisa_csaf_otUS
Siemens SIMATIC PDM< V9.2cisa_csaf_otUS
Siemens SIMATIC STEP 7 V5.X< V5.6_SP2_HF3cisa_csaf_otUS
Siemens SINAMICS STARTER (containing STEP 7 OEM version)< V5.4_HF2cisa_csaf_otUS
Siemens SIMATIC PCS 7 V8.2 and earlier≤ All versionsenisa_euvdEU
Siemens SIMATIC PCS 7 V9.0All versions → V9.0 SP3enisa_euvdEU
Siemens SIMATIC PDMAll versions → V9.2enisa_euvdEU
Siemens SIMATIC STEP 7 V5.XAll versions → V5.6 SP2 HF3enisa_euvdEU
Siemens SINAMICS STARTER (containing STEP 7 OEM version)All versions → V5.4 HF2enisa_euvdEU
siemens simatic pcs firmware≤ 8.2nvdUScpe:2.3:o:siemens:simatic_pcs_firmware:*:*:*:*:*:*:*:*
siemens simatic pcs firmware= 9.0nvdUScpe:2.3:o:siemens:simatic_pcs_firmware:*:*:*:*:*:*:*:*
siemens simatic pdm firmware< 9.2nvdUScpe:2.3:o:siemens:simatic_pdm_firmware:*:*:*:*:*:*:*:*
siemens simatic step 7 firmware≤ 5.6nvdUScpe:2.3:o:siemens:simatic_step_7_firmware:*:*:*:*:*:*:*:*
siemens sinamics starter firmware< 5.4nvdUScpe:2.3:o:siemens:sinamics_starter_firmware:*:*:*:*:*:*:*:*

20 von 26 angezeigt

Advisories (2)

Hersteller- und Ökosystem-Meldungen dazu.

SSA-641963SSA-641963: Remote Code Execution Vulnerability in Multiple SIMATIC Software Products2021-07-13csaf · siemens_psirtDE
Multiple SIMATIC Software products are affected by a vulnerability that could allow an attacker to manipulate project files and remotely execute code. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available.
ICSA-21-194-05Siemens SIMATIC Software Products2021-07-13icsa · cisa_csaf_otUS
Multiple SIMATIC Software products are affected by a vulnerability that could allow an attacker to manipulate project files and remotely execute code. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available.

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd cisa_csaf_ot nvd siemens_psirt NVD CVE.org MITRE

veröffentlicht 2021-07-13geändert 2026-06-17

Referenzen (7)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan