CVE-2021-33626

mediumPriorität · verfolgen · 31EPSS 0.003 · 23. PerzentilDEEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.31% (23rd) EPSS

CVSS 4.6 · medium

Is it mine?

60 products

Prüfe deine Angriffsfläche

Who says so?

4 sources

cnnvd · enisa_euvd · nvd · siemens_psirt

EPSS · bewertet 2026-10-27

A vulnerability exists in SMM (System Management Mode) branch that registers a SWSMI handler that does not sufficiently check or validate the allocated buffer pointer(QWORD values for CommBuffer). This can be used by an attacker to corrupt data in SMRAM memory and even lead to arbitrary code execution.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

BehobenRUGGEDCOM APE1808 - BIOSsiemens_psirt
Update to V1.0.202N or later version
https://support.industry.siemens.com/cs/ww/en/view/109814796/
BehobenSIMATIC Field PG M5siemens_psirt
Update to V22.01.10 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
BehobenSIMATIC Field PG M6siemens_psirt
Update to V26.01.13 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
BehobenSIMATIC IPC127Esiemens_psirt
Update to V27.01.09 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
BehobenSIMATIC IPC227Gsiemens_psirt
Update to V28.01.04 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
BehobenSIMATIC IPC277Gsiemens_psirt
Update to V28.01.04 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
BehobenSIMATIC IPC327Gsiemens_psirt
Update to V28.01.04 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
BehobenSIMATIC IPC377Gsiemens_psirt
Update to V28.01.04 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
BehobenSIMATIC IPC427Esiemens_psirt
Update to V21.01.17 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
BehobenSIMATIC IPC477Esiemens_psirt
Update to V21.01.17 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
BehobenSIMATIC IPC477E Prosiemens_psirt
Update to V21.01.17 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
BehobenSIMATIC IPC627Esiemens_psirt
Update to V25.02.12 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
BehobenSIMATIC IPC647Esiemens_psirt
Update to V25.02.12 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
BehobenSIMATIC IPC677Esiemens_psirt
Update to V25.02.12 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
BehobenSIMATIC IPC847Esiemens_psirt
Update to V25.02.12 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
BehobenSIMATIC ITP1000siemens_psirt
Update to V23.01.10 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
BehobenSIMATIC IPC277G PROsiemens_psirt
Update to V28.01.04 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
BehobenSIPLUS IPC427Esiemens_psirt
Update to V21.01.17 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
MitigationRUGGEDCOM APE1808 - BIOSsiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code
MitigationSIMATIC Field PG M5siemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code
MitigationSIMATIC Field PG M6siemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code
MitigationSIMATIC IPC127Esiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code
MitigationSIMATIC IPC227Gsiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code
MitigationSIMATIC IPC277Gsiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code
MitigationSIMATIC IPC327Gsiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code
MitigationSIMATIC IPC377Gsiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code
MitigationSIMATIC IPC427Esiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code
MitigationSIMATIC IPC477Esiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code
MitigationSIMATIC IPC477E Prosiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code
MitigationSIMATIC IPC627Esiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code
MitigationSIMATIC IPC647Esiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code
MitigationSIMATIC IPC677Esiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code
MitigationSIMATIC IPC847Esiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code
MitigationSIMATIC ITP1000siemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code
MitigationSIMATIC IPC277G PROsiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code
MitigationSIPLUS IPC427Esiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

7.8

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 4.6–7.8

v2.04.6mediumAV:L/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 6.4

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 1.8 · Auswirkung 5.9

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · Siemens ProductCERT DE

v3.17.1highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-829USprimärCWE-829US

betroffene Produkte (60)

Betroffene Produkte und Versionsbereiche.

n/a n/a≤ n/aenisa_euvdEU
insyde insydeh2o5.1 → 5.16.25nvdUScpe:2.3:o:insyde:insydeh2o:*:*:*:*:*:*:*:*
insyde insydeh2o5.2 → 5.25.44nvdUScpe:2.3:o:insyde:insydeh2o:*:*:*:*:*:*:*:*
insyde insydeh2o5.2 → 5.26.25nvdUScpe:2.3:o:insyde:insydeh2o:*:*:*:*:*:*:*:*
insyde insydeh2o5.3 → 5.34.44nvdUScpe:2.3:o:insyde:insydeh2o:*:*:*:*:*:*:*:*
insyde insydeh2o5.3 → 5.35.25nvdUScpe:2.3:o:insyde:insydeh2o:*:*:*:*:*:*:*:*
insyde insydeh2o5.4 → 5.42.44nvdUScpe:2.3:o:insyde:insydeh2o:*:*:*:*:*:*:*:*
insyde insydeh2o5.4 → 5.43.25nvdUScpe:2.3:o:insyde:insydeh2o:*:*:*:*:*:*:*:*
siemens ruggedcom apr1808 firmwarealle VersionennvdUScpe:2.3:o:siemens:ruggedcom_apr1808_firmware:*:*:*:*:*:*:*:*
siemens simatic field pg m5 firmwarealle VersionennvdUScpe:2.3:o:siemens:simatic_field_pg_m5_firmware:*:*:*:*:*:*:*:*
siemens simatic field pg m6 firmwarealle VersionennvdUScpe:2.3:o:siemens:simatic_field_pg_m6_firmware:*:*:*:*:*:*:*:*
siemens simatic ipc127e firmwarealle VersionennvdUScpe:2.3:o:siemens:simatic_ipc127e_firmware:*:*:*:*:*:*:*:*
siemens simatic ipc227g firmwarealle VersionennvdUScpe:2.3:o:siemens:simatic_ipc227g_firmware:*:*:*:*:*:*:*:*
siemens simatic ipc277g firmwarealle VersionennvdUScpe:2.3:o:siemens:simatic_ipc277g_firmware:*:*:*:*:*:*:*:*
siemens simatic ipc327g firmwarealle VersionennvdUScpe:2.3:o:siemens:simatic_ipc327g_firmware:*:*:*:*:*:*:*:*
siemens simatic ipc377g firmwarealle VersionennvdUScpe:2.3:o:siemens:simatic_ipc377g_firmware:*:*:*:*:*:*:*:*
siemens simatic ipc427e firmwarealle VersionennvdUScpe:2.3:o:siemens:simatic_ipc427e_firmware:*:*:*:*:*:*:*:*
siemens simatic ipc477e firmwarealle VersionennvdUScpe:2.3:o:siemens:simatic_ipc477e_firmware:*:*:*:*:*:*:*:*
siemens simatic ipc477e pro firmwarealle VersionennvdUScpe:2.3:o:siemens:simatic_ipc477e_pro_firmware:*:*:*:*:*:*:*:*
siemens simatic ipc627e firmwarealle VersionennvdUScpe:2.3:o:siemens:simatic_ipc627e_firmware:*:*:*:*:*:*:*:*

20 von 60 angezeigt

Advisories (1)

Hersteller- und Ökosystem-Meldungen dazu.

SSA-306654SSA-306654: Insyde BIOS Vulnerabilities in Siemens Industrial Products2022-02-22csaf · siemens_psirtDE
Insyde has published information on vulnerabilities in Insyde BIOS in February 2022. This advisory lists the Siemens Industrial products affected by these vulnerabilities. Siemens has released new versions for the affected products and recommends to update to the latest versions.

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd nvd siemens_psirt NVD CVE.org MITRE

veröffentlicht 2021-10-01geändert 2026-08-11

verwandt (460)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2026-0770US	—OT kritisch	62.6% (99th)	KEV	2026-01-23
Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary…
CVE-2025-32463US	high7.8OT kritisch	55.5% (99th)	KEV	2025-06-30
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.
CVE-2018-17246US	critical9.8	84.3% (100th)	Exploit	2018-12-20
Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that…
CVE-2023-48022US	critical9.8OT hoch	83.9% (100th)	Exploit	2023-11-28
Anyscale Ray 2.6.3 and 2.8.0 allows a remote attacker to execute arbitrary code via the job submission API. NOTE: the vendor's position is that this report is irrelevant because Ra…
CVE-1999-0661US	high10.0	54.2% (99th)	Exploit	1999-01-01
A system is running a version of software that was replaced with a Trojan Horse at one of its distribution points, such as (1) TCP Wrappers 7.6, (2) util-linux 2.9g, (3) wuarchive…

+455 weitere

Referenzen (17)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan