CVE-2021-40359
mediumPriorität · verfolgen · 20EPSS 0.012 · 67. PerzentilDEEUUSEPSS · bewertet 2026-10-22
A vulnerability has been identified in OpenPCS 7 V8.2 (All versions), OpenPCS 7 V9.0 (All versions < V9.0 Upd4), OpenPCS 7 V9.1 (All versions), SIMATIC BATCH V8.2 (All versions), SIMATIC BATCH V9.0 (All versions), SIMATIC BATCH V9.1 (All versions), SIMATIC NET PC Software V14 (All versions), SIMATIC NET PC Software V15 (All versions), SIMATIC NET PC Software V16 (All versions < V16 Update 6), SIMATIC NET PC Software V17 (All versions < V17 SP1), SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC04), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMATIC Route Control V8.2 (All versions), SIMATIC Route Control V9.0 (All versions), SIMATIC Route Control V9.1 (All versions), SIMATIC WinCC V15 and earlier (All versions < V15 SP1 Update 7), SIMATIC WinCC V16 (All versions < V16 Update 5), SIMATIC WinCC V17 (All versions < V17 Update 2), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 19), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 5). When downloading files, the affected systems do not properly neutralize special elements within the pathname. An attacker could then cause the pathname to resolve to a location outside of the restricted directory on the server and read unexpected critical files.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- BehobenOpenPCS 7 V9.0siemens_psirt
Update to V9.0 Upd4 or later version; V9.0 Upd4 is bundled in PCS 7 V9.0 SP3 UC04
https://support.industry.siemens.com/cs/ww/en/view/109780528/ - BehobenOpenPCS 7 V9.1siemens_psirt
See remediation for SIMATIC PCS 7 V9.1
- BehobenSIMATIC BATCH V9.1siemens_psirt
See remediation for SIMATIC PCS 7 V9.1
- BehobenSIMATIC NET PC Software V16siemens_psirt
Update to V16 Update 6 or later version
https://support.industry.siemens.com/cs/ww/en/view/109811815/ - BehobenSIMATIC NET PC Software V17siemens_psirt
Update to V17 SP1 or later version
https://support.industry.siemens.com/cs/ww/de/view/109808270/ - BehobenSIMATIC PCS 7 V8.2siemens_psirt
Update to V8.2 SP1; then update SIMATIC WinCC to V7.4 SP1 Update 19 or later version to fix CVE-2021-40358 and CVE-2021-40364
https://support.industry.siemens.com/cs/ww/en/view/109806846/ - BehobenSIMATIC PCS 7 V9.0siemens_psirt
Update to V9.0 SP3 UC04 or later version to fix CVE-2021-40358 and CVE-2021-40364
https://support.industry.siemens.com/cs/ww/en/view/109780528/ - BehobenSIMATIC PCS 7 V9.1siemens_psirt
Update to V9.1 SP1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109805073/ - BehobenSIMATIC Route Control V9.1siemens_psirt
See remediation for SIMATIC PCS 7 V9.1
- BehobenSIMATIC WinCC V15 and earliersiemens_psirt
Update to V15 SP1 Update 7 or later version
https://support.industry.siemens.com/cs/us/en/view/109763890/ - BehobenSIMATIC WinCC V16siemens_psirt
Update to V16 Update 5 or later version
https://support.industry.siemens.com/cs/ww/en/view/109776017/ - BehobenSIMATIC WinCC V17siemens_psirt
Update to V17 Update 2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109784441/ - BehobenSIMATIC WinCC V7.4siemens_psirt
Update to V7.4 SP1 Update 19 or later version
https://support.industry.siemens.com/cs/ww/en/view/109806846/ - BehobenSIMATIC WinCC V7.5siemens_psirt
Update to V7.5 SP2 Update 5 or later version
https://support.industry.siemens.com/cs/ww/en/view/109793460/ - BehobenOpenPCS 7 V9.0cisa_csaf_ot
Update to V9.0 Upd4 or later version; V9.0 Upd4 is bundled in PCS 7 V9.0 SP3 UC04
https://support.industry.siemens.com/cs/ww/en/view/109780528/ - BehobenOpenPCS 7 V9.1cisa_csaf_ot
See remediation for SIMATIC PCS 7 V9.1
- BehobenSIMATIC BATCH V9.1cisa_csaf_ot
See remediation for SIMATIC PCS 7 V9.1
- BehobenSIMATIC NET PC Software V16cisa_csaf_ot
Update to V16 Update 6 or later version
https://support.industry.siemens.com/cs/ww/en/view/109811815/ - BehobenSIMATIC NET PC Software V17cisa_csaf_ot
Update to V17 SP1 or later version
https://support.industry.siemens.com/cs/ww/de/view/109808270/ - BehobenSIMATIC PCS 7 V8.2cisa_csaf_ot
Update to V8.2 SP1; then update SIMATIC WinCC to V7.4 SP1 Update 19 or later version to fix CVE-2021-40358 and CVE-2021-40364
https://support.industry.siemens.com/cs/ww/en/view/109806846/ - BehobenSIMATIC PCS 7 V9.0cisa_csaf_ot
Update to V9.0 SP3 UC04 or later version to fix CVE-2021-40358 and CVE-2021-40364
https://support.industry.siemens.com/cs/ww/en/view/109780528/ - BehobenSIMATIC PCS 7 V9.1cisa_csaf_ot
Update to V9.1 SP1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109805073/ - BehobenSIMATIC Route Control V9.1cisa_csaf_ot
See remediation for SIMATIC PCS 7 V9.1
- BehobenSIMATIC WinCC V15 and earliercisa_csaf_ot
Update to V15 SP1 Update 7 or later version
https://support.industry.siemens.com/cs/us/en/view/109763890/ - BehobenSIMATIC WinCC V16cisa_csaf_ot
Update to V16 Update 5 or later version
https://support.industry.siemens.com/cs/ww/en/view/109776017/ - BehobenSIMATIC WinCC V17cisa_csaf_ot
Update to V17 Update 2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109784441/ - BehobenSIMATIC WinCC V7.4cisa_csaf_ot
Update to V7.4 SP1 Update 19 or later version
https://support.industry.siemens.com/cs/ww/en/view/109806846/ - BehobenSIMATIC WinCC V7.5cisa_csaf_ot
Update to V7.5 SP2 Update 5 or later version
https://support.industry.siemens.com/cs/ww/en/view/109793460/ - MitigationOpenPCS 7 V8.2siemens_psirt
The vulnerability is fixed if SIMATIC WinCC V7.4 SP1 Update 19 or later version is installed on the same system
- MitigationSIMATIC BATCH V8.2siemens_psirt
The vulnerability is fixed if SIMATIC WinCC V7.4 SP1 Update 19 or later version is installed on the same system
- MitigationSIMATIC BATCH V9.0siemens_psirt
The vulnerability is fixed if SIMATIC WinCC V7.4 SP1 Update 19 or later version is installed on the same system
- MitigationSIMATIC PCS 7 V8.2siemens_psirt
To fix CVE-2021-40359 see chapter "Additional Information"
- MitigationSIMATIC PCS 7 V9.0siemens_psirt
To fix CVE-2021-40359 see chapter "Additional Information"
- MitigationSIMATIC Route Control V8.2siemens_psirt
The vulnerability is fixed if SIMATIC WinCC V7.4 SP1 Update 19 or later version is installed on the same system
- MitigationSIMATIC Route Control V9.0siemens_psirt
The vulnerability is fixed if SIMATIC WinCC V7.4 SP1 Update 19 or later version is installed on the same system
- MitigationOpenPCS 7 V8.2cisa_csaf_ot
The vulnerability is fixed if SIMATIC WinCC V7.4 SP1 Update 19 or later version is installed on the same system
- MitigationSIMATIC BATCH V8.2cisa_csaf_ot
The vulnerability is fixed if SIMATIC WinCC V7.4 SP1 Update 19 or later version is installed on the same system
- MitigationSIMATIC BATCH V9.0cisa_csaf_ot
The vulnerability is fixed if SIMATIC WinCC V7.4 SP1 Update 19 or later version is installed on the same system
- MitigationSIMATIC PCS 7 V8.2cisa_csaf_ot
To fix CVE-2021-40359 see chapter "Additional Information"
- MitigationSIMATIC PCS 7 V9.0cisa_csaf_ot
To fix CVE-2021-40359 see chapter "Additional Information"
- MitigationSIMATIC Route Control V8.2cisa_csaf_ot
The vulnerability is fixed if SIMATIC WinCC V7.4 SP1 Update 19 or later version is installed on the same system
- MitigationSIMATIC Route Control V9.0cisa_csaf_ot
The vulnerability is fixed if SIMATIC WinCC V7.4 SP1 Update 19 or later version is installed on the same system
- Kein Fix geplantOpenPCS 7 V8.2siemens_psirt
Currently no fix is planned
- Kein Fix geplantSIMATIC BATCH V8.2siemens_psirt
Currently no fix is planned
- Kein Fix geplantSIMATIC BATCH V9.0siemens_psirt
Currently no fix is planned
- Kein Fix geplantSIMATIC NET PC Software V14siemens_psirt
Currently no fix is planned
- Kein Fix geplantSIMATIC NET PC Software V15siemens_psirt
Currently no fix is planned
- Kein Fix geplantSIMATIC Route Control V8.2siemens_psirt
Currently no fix is planned
- Kein Fix geplantSIMATIC Route Control V9.0siemens_psirt
Currently no fix is planned
- Kein Fix geplantOpenPCS 7 V8.2cisa_csaf_ot
Currently no fix is planned
- Kein Fix geplantSIMATIC BATCH V8.2cisa_csaf_ot
Currently no fix is planned
- Kein Fix geplantSIMATIC BATCH V9.0cisa_csaf_ot
Currently no fix is planned
- Kein Fix geplantSIMATIC NET PC Software V14cisa_csaf_ot
Currently no fix is planned
- Kein Fix geplantSIMATIC NET PC Software V15cisa_csaf_ot
Currently no fix is planned
- Kein Fix geplantSIMATIC Route Control V8.2cisa_csaf_ot
Currently no fix is planned
- Kein Fix geplantSIMATIC Route Control V9.0cisa_csaf_ot
Currently no fix is planned
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 4.3–7.7
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (102)
Betroffene Produkte und Versionsbereiche.
Advisories (2)
Hersteller- und Ökosystem-Meldungen dazu.
- SSA-840188SSA-840188: Multiple Vulnerabilities in SIMATIC WinCC Affecting Other SIMATIC Software Products2021-11-09csaf · siemens_psirtDE
Multiple vulnerabilities were found in SIMATIC WinCC that ultimately could allow local or remote attackers to escalate privileges and read, write or delete critical files. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available. Note: The vulnerability CVE-2021-40359 is part of a shared component, used by various Siemens products (SIMATIC Communication Services - SCS). The installation of a fix version of any product also removes the vulnerability for other products on the same system, even if those products were not updated.
- ICSA-21-315-03Siemens SIMATIC WinCC (Update E)2021-11-09icsa · cisa_csaf_otUS
Multiple vulnerabilities were found in SIMATIC WinCC that ultimately could allow local or remote attackers to escalate privileges and read, write or delete critical files. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available. Note: The vulnerability CVE-2021-40359 is part of a shared component, used by various Siemens products (SIMATIC Communication Services - SCS). The installation of a fix version of any product also removes the vulnerability for other products on the same system, even if those products were not updated.
auch bekannt als (3)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (6)
Externe Belege — Patches, Meldungen, Analysen.
- https://cert-portal.siemens.com/productcert/pdf/ssa-840188.pdfcnnvd
- https://us-cert.cisa.gov/ics/advisories/icsa-21-315-03cnnvd
- https://vigilance.fr/vulnerability/SIMATIC-multiple-vulnerabilities-via-WinCC-36835cnnvd
- https://www.auscert.org.au/bulletins/ESB-2021.3874cnnvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-840188.pdfenisa_euvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-840188.pdfVendor Advisorynvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan