CVE-2021-40363

lowPriorität · verfolgen · 31OT-Risiko · erhöhtEPSS 0.002 · 5. PerzentilDEEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.16% (5th) EPSS

CVSS 2.1 · low

Is it mine?

55 products

Prüfe deine Angriffsfläche

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · bewertet 2026-10-22

A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMATIC WinCC V15 and earlier (All versions < V15 SP1 Update 7), SIMATIC WinCC V16 (All versions < V16 Update 5), SIMATIC WinCC V17 (All versions < V17 Update 2), SIMATIC WinCC V17 (All versions <= V17 Update 4), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 19), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 6). The affected component stores the credentials of a local system account in a potentially publicly accessible project file using an outdated cipher algorithm. An attacker may use this to brute force the credentials and take over the system.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

BehobenSIMATIC PCS 7 V8.2siemens_psirt
Install SIMATIC WinCC V7.4 SP1 Update 19 or later version
https://support.industry.siemens.com/cs/ww/en/view/109806846/
BehobenSIMATIC PCS 7 V9.0siemens_psirt
Update to V9.0 SP3 UpdateCollection04 or later version
https://support.industry.siemens.com/cs/ww/en/view/109780528/
BehobenSIMATIC PCS 7 V9.1siemens_psirt
Update to V9.1 SP1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109805073/
BehobenSIMATIC WinCC V15 and earliersiemens_psirt
Update to V15 SP1 Update 7 or later version
https://support.industry.siemens.com/cs/us/en/view/109763890/
BehobenSIMATIC WinCC V16siemens_psirt
Update to V16 Update 5 or later version
https://support.industry.siemens.com/cs/ww/en/view/109776017/
BehobenSIMATIC WinCC V17siemens_psirt
Update to V17 Update 2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109784441/
BehobenSIMATIC WinCC V7.4siemens_psirt
Update to V7.4 SP1 Update 19 or later version
https://support.industry.siemens.com/cs/ww/en/view/109806846/
BehobenSIMATIC WinCC V7.5siemens_psirt
Update to V7.5 SP2 Update 6 or later version
https://support.industry.siemens.com/cs/ww/en/view/109793460/
BehobenSIMATIC PCS 7 V8.2cisa_csaf_ot
Install SIMATIC WinCC V7.4 SP1 Update 19 or later version
https://support.industry.siemens.com/cs/ww/en/view/109806846/
BehobenSIMATIC PCS 7 V9.0cisa_csaf_ot
Update to V9.0 SP3 UpdateCollection04 or later version
https://support.industry.siemens.com/cs/ww/en/view/109780528/
BehobenSIMATIC PCS 7 V9.1cisa_csaf_ot
Update to V9.1 SP1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109805073/
BehobenSIMATIC WinCC V15 and earliercisa_csaf_ot
Update to V15 SP1 Update 7 or later version
https://support.industry.siemens.com/cs/us/en/view/109763890/
BehobenSIMATIC WinCC V16cisa_csaf_ot
Update to V16 Update 5 or later version
https://support.industry.siemens.com/cs/ww/en/view/109776017/
BehobenSIMATIC WinCC V17cisa_csaf_ot
Update to V17 Update 2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109784441/
BehobenSIMATIC WinCC V7.4cisa_csaf_ot
Update to V7.4 SP1 Update 19 or later version
https://support.industry.siemens.com/cs/ww/en/view/109806846/
BehobenSIMATIC WinCC V7.5cisa_csaf_ot
Update to V7.5 SP2 Update 6 or later version
https://support.industry.siemens.com/cs/ww/en/view/109793460/
MitigationSIMATIC PCS 7 V8.2siemens_psirt
CVE-2021-40363: Harden the application's host to prevent local access by untrusted personnel
MitigationSIMATIC PCS 7 V9.0siemens_psirt
CVE-2021-40363: Harden the application's host to prevent local access by untrusted personnel
MitigationSIMATIC PCS 7 V9.1siemens_psirt
CVE-2021-40363: Harden the application's host to prevent local access by untrusted personnel
MitigationSIMATIC WinCC V15 and earliersiemens_psirt
CVE-2021-40363: Harden the application's host to prevent local access by untrusted personnel
MitigationSIMATIC WinCC V16siemens_psirt
CVE-2021-40363: Harden the application's host to prevent local access by untrusted personnel
MitigationSIMATIC WinCC V17siemens_psirt
CVE-2021-40363: Harden the application's host to prevent local access by untrusted personnel
MitigationSIMATIC WinCC V7.4siemens_psirt
CVE-2021-40363: Harden the application's host to prevent local access by untrusted personnel
MitigationSIMATIC WinCC V7.5siemens_psirt
CVE-2021-40363: Harden the application's host to prevent local access by untrusted personnel
MitigationSIMATIC PCS 7 V8.2cisa_csaf_ot
CVE-2021-40363: Harden the application's host to prevent local access by untrusted personnel
MitigationSIMATIC PCS 7 V9.0cisa_csaf_ot
CVE-2021-40363: Harden the application's host to prevent local access by untrusted personnel
MitigationSIMATIC PCS 7 V9.1cisa_csaf_ot
CVE-2021-40363: Harden the application's host to prevent local access by untrusted personnel
MitigationSIMATIC WinCC V15 and earliercisa_csaf_ot
CVE-2021-40363: Harden the application's host to prevent local access by untrusted personnel
MitigationSIMATIC WinCC V16cisa_csaf_ot
CVE-2021-40363: Harden the application's host to prevent local access by untrusted personnel
MitigationSIMATIC WinCC V17cisa_csaf_ot
CVE-2021-40363: Harden the application's host to prevent local access by untrusted personnel
MitigationSIMATIC WinCC V7.4cisa_csaf_ot
CVE-2021-40363: Harden the application's host to prevent local access by untrusted personnel
MitigationSIMATIC WinCC V7.5cisa_csaf_ot
CVE-2021-40363: Harden the application's host to prevent local access by untrusted personnel
Kein Fix geplantSIMATIC PCS 7 V8.2siemens_psirt
Currently no fix is planned
Kein Fix geplantSIMATIC PCS 7 V8.2cisa_csaf_ot
Currently no fix is planned

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

7.8

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · low–high · 2.1–7.8

v2.02.1lowAV:L/AC:L/Au:N/C:P/I:N/A:Nprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 2.9

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 1.8 · Auswirkung 5.9

v3.15.5mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:Csecondary · CISA US

v3.15.5mediumAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Nsecondary · FSTEC (BDU) RU

v3.15.5mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:Csecondary · Siemens ProductCERT DE

v3.17.1highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-312USCWE-326USCWE-538USCWE-538USCWE-538USCWE-538US

betroffene Produkte (55)

Betroffene Produkte und Versionsbereiche.

SIMATIC PCS 7 V8.2alle Versionencisa_csaf_otUS
SIMATIC PCS 7 V9.0alle Versionencisa_csaf_otUS
SIMATIC PCS 7 V9.1alle Versionencisa_csaf_otUS
SIMATIC WinCC V15 and earlieralle Versionencisa_csaf_otUS
SIMATIC WinCC V16alle Versionencisa_csaf_otUS
SIMATIC WinCC V17alle Versionencisa_csaf_otUS
SIMATIC WinCC V7.4alle Versionencisa_csaf_otUS
SIMATIC WinCC V7.5alle Versionencisa_csaf_otUS
Siemens SIMATIC PCS 7 V8.2≤ vers:all/*cisa_csaf_otUS
Siemens SIMATIC PCS 7 V9.0≤ vers:all/*cisa_csaf_otUS
Siemens SIMATIC PCS 7 V9.1< V9.1_SP1cisa_csaf_otUS
Siemens SIMATIC WinCC V15 and earlier< V15_SP1_Update_7cisa_csaf_otUS
Siemens SIMATIC WinCC V16< V16_Update_5cisa_csaf_otUS
Siemens SIMATIC WinCC V17< V17_Update_2cisa_csaf_otUS
Siemens SIMATIC WinCC V17V17_Update_2_ → V17_Update_4cisa_csaf_otUS
Siemens SIMATIC WinCC V7.4< V7.4_SP1_Update_19cisa_csaf_otUS
Siemens SIMATIC WinCC V7.5< V7.5_SP2_Update_6cisa_csaf_otUS
Siemens SIMATIC PCS 7 V8.2≤ All versionsenisa_euvdEU
Siemens SIMATIC PCS 7 V9.0≤ All versionsenisa_euvdEU
Siemens SIMATIC PCS 7 V9.1All versions → V9.1 SP1enisa_euvdEU

20 von 55 angezeigt

Advisories (2)

Hersteller- und Ökosystem-Meldungen dazu.

SSA-914168SSA-914168: Multiple Vulnerabilities in SIMATIC WinCC Affecting Other SIMATIC Software Products2022-02-08csaf · siemens_psirtDE
Multiple vulnerabilities were found in SIMATIC WinCC that ultimately could allow attackers to retrieve and brute force password hashes and access other systems. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens is preparing further updates and recommends specific countermeasures for products where updates are not, or not yet available.
ICSA-22-041-02Siemens SIMATIC WinCC and PCS2022-02-08icsa · cisa_csaf_otUS
Multiple vulnerabilities were found in SIMATIC WinCC that ultimately could allow attackers to retrieve and brute force password hashes and access other systems. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens is preparing further updates and recommends specific countermeasures for products where updates are not, or not yet available.

auch bekannt als (4)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu cisa_csaf_ot siemens_psirt NVD CVE.org MITRE

veröffentlicht 2022-02-09geändert 2026-06-17

Referenzen (8)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan