CVE-2021-45046
mediumPriorität · handeln · 90OT-Risiko · kritischKEV · ausgenutztEPSS 1.000 · 100. PerzentilExploit · funktionalDEEURUUShinzugefügt 2023-05-01beheben bis 2023-05-22
erforderliche Maßnahme Apply updates per vendor instructions.
EPSS · bewertet 2026-10-22
Apache Log4j2 Deserialization of Untrusted Data Vulnerability
It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- BehobenSensformer / Sensgear Platformsiemens_psirt
Vulnerabilities fixed on central cloud service between 2021-12-10 (CVE-2021-44228) and 2021-12-21 (CVE-2021-45105); no user actions necessary
- BehobenAdvantage Navigator Energy & Sustainabilitysiemens_psirt
Vulnerability CVE-2021-44228 fixed on central cloud service starting 2021-12-13; no user actions necessary
- BehobenAdvantage Navigator Software Proxy V6siemens_psirt
Update to V6.3 or later version
- BehobenBuilding Operator Discovery Distribution for the Connect X200 Gatewaysiemens_psirt
Update to V3.0.30 or later version
https://support.industry.siemens.com/cs/ww/en/view/109805593/ - BehobenBuilding Operator Discovery Distribution for the Connect X300 Gatewaysiemens_psirt
Update to V3.0.29 or later version
https://support.industry.siemens.com/cs/ww/en/view/109805593/ - BehobenBuilding Twin - 360° Viewersiemens_psirt
Vulnerability CVE-2021-44228 fixed on central cloud service; no user actions necessary
- BehobenCOMOSsiemens_psirt
Update to V10.4.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812011/ - BehobenCapital V2019.1siemens_psirt
Update to V2019.1 SP2204 or later version
https://support.sw.siemens.com/en- US/product/861057055/downloads - BehobenCapital V2020.1siemens_psirt
Update to V2020.1 SP2202 or later version
https://support.sw.siemens.com/en- US/product/861057055/downloads - BehobenCapital V2021.1siemens_psirt
Update to V2021.1 SP2202 or later version
https://support.sw.siemens.com/en- US/product/861057055/downloads - BehobenCerberus DMS V5.0siemens_psirt
Remove the JndiLookup class from the classpath. Detailed instructions are available at https://support.industry.siemens.com/cs/ww/en/view/109805562/
- BehobenCerberus DMS V5.1siemens_psirt
Remove the JndiLookup class from the classpath. Detailed instructions are available at https://support.industry.siemens.com/cs/ww/en/view/109805562/
- BehobenDesigo CC V3.0siemens_psirt
Remove the JndiLookup class from the classpath. Detailed instructions are available at https://support.industry.siemens.com/cs/ww/en/view/109805562/
- BehobenDesigo CC V4.0siemens_psirt
Remove the JndiLookup class from the classpath. Detailed instructions are available at https://support.industry.siemens.com/cs/ww/en/view/109805562/
- BehobenDesigo CC V4.1siemens_psirt
Remove the JndiLookup class from the classpath. Detailed instructions are available at https://support.industry.siemens.com/cs/ww/en/view/109805562/
- BehobenDesigo CC V4.2siemens_psirt
Remove the JndiLookup class from the classpath. Detailed instructions are available at https://support.industry.siemens.com/cs/ww/en/view/109805562/
- BehobenDesigo CC V5.0siemens_psirt
Remove the JndiLookup class from the classpath. Detailed instructions are available at https://support.industry.siemens.com/cs/ww/en/view/109805562/
- BehobenDesigo CC V5.1siemens_psirt
Update to V5.1 QU1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109807893/ - BehobenE-Car OC Cloud Applicationsiemens_psirt
Vulnerability CVE-2021-44228 fixed on central cloud service starting 2021-12-13; no user actions necessary
- BehobenEnergy Engagesiemens_psirt
Find detailed remediation and mitigation information on the EnergyIP docs portal at: https://docs.emeter.com/display/public/WELCOME/Energy IP+Security+Advisory+for+Log4Shell+Vulnerability
- BehobenEnergyIPsiemens_psirt
Find detailed remediation and mitigation information on the EnergyIP docs portal at: https://docs.emeter.com/display/public/WELCOME/Energy IP+Security+Advisory+for+Log4Shell+Vulnerability
- BehobenEnlighted Amazesiemens_psirt
Vulnerabilities fixed on central cloud services starting 2021-12-10; no user actions necessary
- BehobenEnlighted Wheresiemens_psirt
Vulnerabilities fixed on central cloud services starting 2021-12-11; no user actions necessary
- BehobenGMA-Managersiemens_psirt
Update to V8.6.2.472 or later version
https://support.industry.siemens.com/cs/ww/en/view/109805665/ - BehobenGeolus Shape Search V10siemens_psirt
Remove the JndiLookup class from the classpath.
- BehobenGeolus Shape Search V11siemens_psirt
Remove the JndiLookup class from the classpath.
- BehobenHEEDS Connectsiemens_psirt
HEEDS Connect team will contact all impacted customers to deploy a new log4j version. This action will secure your installation against Log4Shell vulnerability. For further information see: https://support.sw.siemens.com/en-US/knowledge-base/PL8601661
- BehobenHES UDISsiemens_psirt
Specific fix versions based on V6.0.2 and V6.0.3 were released and deployed for all affected projects
- BehobenIndustrial Edge Hubsiemens_psirt
Vulnerabilities fixed on central cloud service starting 2021-12-13; no user actions necessary
- BehobenIndustrial Edge Management App (IEM-App)siemens_psirt
Update to V1.4.11 or later version
https://iehub.eu1.edge.siemens.cloud/ - BehobenIndustrial Edge Management OS (IEM-OS)siemens_psirt
Update to V1.4.0-42 or later version
https://iehub.eu1.edge.siemens.cloud/ - BehobenMendix Applicationssiemens_psirt
Although the Mendix runtime itself is not vulnerable to this exploit, we nevertheless recommend to upgrade log4j-core to the latest available version if log4j-core is part of your project. This advice is regardless of the JRE/JDK version the app runs on.
https://status.mendix.com/incidents/8j5043my610c - BehobenMindSphere App Management Cockpits (Developer& Operator)siemens_psirt
Vulnerabilities fixed with update on 2021-12-16; no user actions necessary
- BehobenMindSphere Asset Managersiemens_psirt
Vulnerabilities fixed with update on 2021-12-16; no user actions necessary
- BehobenMindSphere IAM (User Management/ Settings)siemens_psirt
Vulnerabilities fixed with update on 2021-12-16; no user actions necessary
- BehobenMindSphere Integrated Data Lakesiemens_psirt
Vulnerabilities fixed with update on 2021-12-16; no user actions necessary
- BehobenMindSphere Notification Servicesiemens_psirt
Vulnerabilities fixed with update on 2021-12-16; no user actions necessary
- BehobenMindSphere Predictive Learningsiemens_psirt
Vulnerabilities fixed with update on 2021-12-23; no user actions necessary
- BehobenMindSphere Usage Transparency Servicesiemens_psirt
Vulnerabilities fixed with update on 2021-12-16; no user actions necessary
- BehobenMindSphere Visual Explorersiemens_psirt
Vulnerabilities fixed with update on 2021-12-21; no user actions necessary
- BehobenMindsphere Cloud Foundrysiemens_psirt
Although the Cloud Foundry environment itself is not vulnerable to this exploit, we nevertheless recommend to upgrade log4j-core to the latest available version if log4j-core is part of your project. https://support.sw.siemens.com/en-US/product/268530510/knowledge- base/PL8600797
- BehobenMindsphere Cloud Platformsiemens_psirt
Vulnerabilities fixed on central cloud service starting 2021-12-11; no user actions necessary
- BehobenNX 1953 Seriessiemens_psirt
Update to V1973.4340 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600959 - BehobenNX 1980 Seriessiemens_psirt
Update to V2000.3400 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600959 - BehobenNX 2007 Seriessiemens_psirt
Update to V2008 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600959 - BehobenNXpower Monitorsiemens_psirt
Vulnerabilities fixed on central cloud service starting 2021-12-19; no user actions necessary
- BehobenOpcenter EX CP Process Automation Controlsiemens_psirt
Update to V18.1 or later version to fix CVE-2021-44228
- BehobenOpcenter Execution Core Process Automation Controlsiemens_psirt
Update to V18.1 or later version to fix CVE-2021-44228
- BehobenOpcenter Intelligencesiemens_psirt
Update to V3.5 or later version
https://support.sw.siemens.com/ - BehobenOperation Schedulersiemens_psirt
Update the UAA component to V75.8.3
https://support.industry.siemens.com/cs/ww/en/view/109805673/ - BehobenSENTRON powermanager V4siemens_psirt
Remove the JndiLookup class from the classpath. Detailed instructions are available at https://support.industry.siemens.com/cs/ww/en/view/109805602/
- BehobenSIGUARD DSAsiemens_psirt
Update to V4.4.1 or later version
- BehobenSIMATIC IPC1047siemens_psirt
Update the driver for the SmartRAID controller to V2.6.6 or later version, available at https://storage.microsemi.com/en- us/support/raid/sas_raid/asr-3151-4i/
- BehobenSIMATIC IPC1047Esiemens_psirt
Update the driver for the SmartRAID controller to V2.6.6 or later version, available at https://storage.microsemi.com/en- us/support/raid/sas_raid/asr-3151-4i/
- BehobenSIMATIC IPC647Dsiemens_psirt
Follow the remediation steps documented at https://ask.adaptec.com/app/answers/detail/a_id/17527/
- BehobenSIMATIC IPC647Esiemens_psirt
Update the driver for the SmartRAID controller to V2.6.6 or later version, available at https://storage.microsemi.com/en- us/support/raid/sas_raid/asr-3151-4i/
- BehobenSIMATIC IPC847Dsiemens_psirt
Follow the remediation steps documented at https://ask.adaptec.com/app/answers/detail/a_id/17527/
- BehobenSIMATIC IPC847Esiemens_psirt
Update the driver for the SmartRAID controller to V2.6.6 or later version, available at https://storage.microsemi.com/en- us/support/raid/sas_raid/asr-3151-4i/
- BehobenSiPass integrated V2.80siemens_psirt
Apply the patch
https://support.industry.siemens.com/cs/ww/en/view/109805711/ - BehobenSiPass integrated V2.85siemens_psirt
Update to V2.85.7.5 or later version
https://support.industry.siemens.com/cs/ww/en/view/109801507/ - BehobenSimcenter 3Dsiemens_psirt
Update to 2022.1-2008 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8603477 - BehobenSimcenter Amesimsiemens_psirt
Update Teamcenter to any fix version available for the different version lines of Teamcenter, see https://support.sw.siemens.com/en- US/knowledge-base/PL8600700
https://support.sw.siemens.com/en-US/knowledge- base/PL8601572 - BehobenSimcenter System Architectsiemens_psirt
Update Teamcenter to any fix version available for the different version lines of Teamcenter, see https://support.sw.siemens.com/en- US/knowledge-base/PL8600700
https://support.sw.siemens.com/en-US/knowledge- base/PL8601662 - BehobenSimcenter System Simulation Client for Gitsiemens_psirt
Update to V2021.2.2 or later version
https://support.sw.siemens.com - BehobenSimcenter Testlabsiemens_psirt
Follow the remediation steps documented at: https://support.sw.siemens.com/en-US/knowledge-base/PL8602466
- BehobenSimcenter Testlab Data Managementsiemens_psirt
Simcenter Testlab Data Management team will contact all impacted customer to deploy the mitigation measures. This action will secure your installation against Log4Shell vulnerability. For further information see: https://support.sw.siemens.com/en-US/knowledge- base/PL8601418
- BehobenSiveillance Commandsiemens_psirt
Vulnerabilities fixed for Command installations on a project basis; no user actions necessary
- BehobenSiveillance Control Pro V2.1siemens_psirt
A hotfix is available; please contact customer support to receive the hotfix
- BehobenSiveillance Control Pro V2.2siemens_psirt
Update to V2.2.7 or later version; please contact customer support to receive the latest version
- BehobenSiveillance Control Pro V2.3siemens_psirt
Update to V2.3.2 or later version; please contact customer support to receive the latest version
- BehobenSiveillance Identity V1.5siemens_psirt
Update to V1.5 SP4 and apply the patch
https://support.industry.siemens.com/cs/ww/en/view/109805657/ - BehobenSiveillance Identity V1.6siemens_psirt
Update to V1.6 SP1 and apply the patch
https://support.industry.siemens.com/cs/ww/en/view/109805657/ - BehobenSiveillance Vantagesiemens_psirt
Vulnerabilities fixed for Vantage installations on a project basis; no user actions necessary
- BehobenSolid Edge CAM Prosiemens_psirt
Update to V2008 or later version
https://support.sw.siemens.com/ - BehobenSolid Edge Wiring and Harness Designsiemens_psirt
Update to V2022 SP2202 or later version
https://support.sw.siemens.com/en- US/product/246738425/downloads - BehobenSpectrum Power 4siemens_psirt
Update to V4.70 SP9 and apply Security Patch 1. Please contact your local Siemens representative.
- BehobenSpectrum Power 7siemens_psirt
Update to V21Q4 and apply the patch. Please contact your local Siemens representative.
- BehobenTeamcenter Active Workspace V4.3siemens_psirt
Update to V4.3.13 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - BehobenTeamcenter Active Workspace V5.0siemens_psirt
Update to V5.0.11 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - BehobenTeamcenter Active Workspace V5.1siemens_psirt
Update to V5.1.8 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - BehobenTeamcenter Active Workspace V5.2siemens_psirt
Update to V5.2.6 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - BehobenTeamcenter Deployment Center V4.0siemens_psirt
Update to V4.0.3 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - BehobenTeamcenter Deployment Center V4.1siemens_psirt
Update to V4.1.1.1 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - BehobenTeamcenter Deployment Center V4.2siemens_psirt
Update to V4.2.0.2 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - BehobenTeamcenter EDA V5.1siemens_psirt
Update to V5.1.5 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - BehobenTeamcenter EDA V5.2siemens_psirt
Update to V5.2.3 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - BehobenTeamcenter Integration Framework V13.0siemens_psirt
Update to V13.0.0.2 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - BehobenTeamcenter Integration Framework V13.1siemens_psirt
Update to V13.1.0.1 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - BehobenTeamcenter Integration Framework V13.2siemens_psirt
Update to V13.2.0.1 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - BehobenTeamcenter Integration Framework V3.3siemens_psirt
Update to V3.3.0.7 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - BehobenTeamcenter Integration Framework V4.0siemens_psirt
Update to V4.0.0.2 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - BehobenTeamcenter Integration for CATIAsiemens_psirt
Update to V13.0.1.2 or later version
https://support.sw.siemens.com/knowledge- base/PL8602463 - BehobenTeamcenter MBSE Gateway V4.1siemens_psirt
Update to V4.1.2 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - BehobenTeamcenter MBSE Gateway V4.2siemens_psirt
Update to V4.2.3 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - BehobenTeamcenter MBSE Gateway V4.3siemens_psirt
Update to V4.3.3 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - BehobenTeamcenter MBSE Gateway V5.0siemens_psirt
Update to V5.0.6 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - BehobenTeamcenter MBSE Gateway V5.1siemens_psirt
Update to V5.1.5 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - BehobenTeamcenter MBSE Gateway V5.2siemens_psirt
Update to V5.2.4 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - BehobenTeamcenter Microservices Framework V5.1siemens_psirt
Update to V5.1.8 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - BehobenTeamcenter Microservices Framework V5.2siemens_psirt
Update to V5.2.6 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - BehobenTeamcenter Reporting and Analytics V11siemens_psirt
Remove the JndiLookup class from the classpath.
- BehobenTeamcenter Reporting and Analytics V12.2siemens_psirt
Update to V12.2.8 or later version
https://support.sw.siemens.com/enUS/knowledge- base/PL8600700 - BehobenTeamcenter Reporting and Analytics V12.3siemens_psirt
Update to V12.3.11 or later version
https://support.sw.siemens.com/enUS/knowledge- base/PL8600700 - BehobenTeamcenter Reporting and Analytics V12.4siemens_psirt
Update to V12.4.1 or later version
https://support.sw.siemens.com/enUS/knowledge- base/PL8600700 - BehobenTeamcenter Reporting and Analytics V13siemens_psirt
Update to V13.2.1.1 or V13.3.0.0 or later version
https://support.sw.siemens.com/enUS/knowledge- base/PL8600700 - BehobenTeamcenter Technical Publishingsiemens_psirt
Update to V13.0.1 or later version
https://support.sw.siemens.com/knowledge- base/PL8612040 - BehobenTeamcenter V12.1siemens_psirt
Update to V12.1.0.14 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - BehobenTeamcenter V12.2siemens_psirt
Update to V12.2.0.18 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - BehobenTeamcenter V12.3siemens_psirt
Update to V12.3.0.15 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - BehobenTeamcenter V12.4siemens_psirt
Update to V12.4.0.12 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - BehobenTeamcenter V13.0siemens_psirt
Update to V13.0.0.9 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - BehobenTeamcenter V13.1siemens_psirt
Update to V13.1.0.8 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - BehobenTeamcenter V13.2siemens_psirt
Update to V13.2.0.6 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - BehobenTeamcenter V13.3siemens_psirt
Update to V13.3.0.1 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - BehobenTecnomatix Intositesiemens_psirt
Vulnerabilities fixed on central cloud service; no user actions necessary
- BehobenTecnomatix Plant Simulationsiemens_psirt
Download and install the updated TCCS setup from the Siemens Support Center; for details see https://support.sw.siemens.com/knowledge- base/PL8615527
- BehobenTecnomatix Process Designersiemens_psirt
Apply the hotfix, available for versions V14.1, V15.0, V15.1, V15.1.2, V16.0, V16.0.1, V16.0.2, V16.1, V16.1.1, V16.1.2
https://support.sw.siemens.com/en-US/knowledge- base/PL8602057 - BehobenTecnomatix Process Simulatesiemens_psirt
Apply the hotfix, available for versions V14.1, V15.0, V15.1, V15.1.2, V16.0, V16.0.1, V16.0.2, V16.1, V16.1.1, V16.1.2
https://support.sw.siemens.com/en-US/knowledge- base/PL8602057 - BehobenTecnomatix Process Simulate VCLitesiemens_psirt
Apply the hotfix, available for versions V14.1, V15.0, V15.1, V15.1.2, V16.0, V16.0.1, V16.0.2, V16.1, V16.1.1, V16.1.2
https://support.sw.siemens.com/en-US/knowledge- base/PL8602057 - BehobenTecnomatix RobotExpertsiemens_psirt
Apply the hotfix, available for versions V14.1, V15.0, V15.1, V15.1.2, V16.0, V16.0.1, V16.0.2, V16.1, V16.1.1, V16.1.2
https://support.sw.siemens.com/en-US/knowledge- base/PL8602057 - BehobenTecnomatix eBOP Manager Serversiemens_psirt
Apply the hotfix
https://support.sw.siemens.com/en-US/knowledge- base/PL8602057 - BehobenValor Parts Library - VPL Directsiemens_psirt
Vulnerabilities fixed on remote VPL server; no user actions necessary
- BehobenValor Parts Library - VPL Server or Servicesiemens_psirt
Remove the JndiLookup class from the classpath.
- BehobenVeSys V2020.1siemens_psirt
Update to V2020.1 SP2202 or later version
https://support.sw.siemens.com/en- US/product/852852123/downloads - BehobenVeSys V2021.1siemens_psirt
Update to V2021.1 SP2202 or later version
https://support.sw.siemens.com/en- US/product/852852123/downloads - BehobenXpedition Enterprise (XCR) VX.2.10siemens_psirt
Update to VX.2.10 Update 4 or later version
https://support.sw.siemens.com/en-US/product/1644094854/download/2022 01034 - BehobenXpedition Enterprise VX.2.10siemens_psirt
Update to VX.2.10 Update 4 or later version
https://support.sw.siemens.com/en-US/product/852852130/download/20220 1033 - BehobenXpedition Enterprise VX.2.6siemens_psirt
Apply the hotfix
https://support.sw.siemens.com/en-US/product/1644094854/knowledge- base/MG618343 - BehobenXpedition Enterprise VX.2.7siemens_psirt
Update to VX.2.7 Update 19 or later version
https://support.sw.siemens.com/en-US/product/852852130/download/20220 1039 - BehobenXpedition Enterprise VX.2.8siemens_psirt
Update to VX.2.8 Update 13 or later version
https://support.sw.siemens.com/en-US/product/852852130/download/20220 1037 - BehobenXpedition IC Packaging (XCR) VX.2.10siemens_psirt
Update to VX.2.10 Update 4 or later version
https://support.sw.siemens.com/en-US/product/1644094857/download/2022 01036 - BehobenXpedition IC Packaging VX.2.10siemens_psirt
Update to VX.2.10 Update 4 or later version
https://support.sw.siemens.com/en-US/product/1091814625/download/2022 01035 - BehobenXpedition IC Packaging VX.2.6siemens_psirt
Apply the hotfix
https://support.sw.siemens.com/en-US/product/1644094854/knowledge- base/MG618343 - BehobenXpedition IC Packaging VX.2.7siemens_psirt
Update to VX.2.7 Update 19 or later version
https://support.sw.siemens.com/en-US/product/1091814625/download/2022 01040 - BehobenXpedition IC Packaging VX.2.8siemens_psirt
Update to VX.2.8 Update 13 or later version
https://support.sw.siemens.com/en-US/product/1091814625/download/2022 01038 - BehobencRSPsiemens_psirt
Update to V13.17.2 was deployed on all cRSP services on 2021-12-21; no user actions necessary
- BehobencRSP Operator Client Startersiemens_psirt
Update to V1.7.18 or later version, as provided via cRSP V13.17.2 or later version
- BehobenjROS for Spectrum Power 4siemens_psirt
Update to V4.70 SP9 Security Patch 1 or later version. Please contact your local Siemens representative.
- BehobenjROS for Spectrum Power 7siemens_psirt
Apply the patch. Please contact your local Siemens representative.
- BehobenFirmware 4.2<4.8.1.4 installed on WAGO Smart Scriptwago_psirt
UPDATE A2/2:Install Version 4.8.1.5 or later of WAGO Smart Script, which is available on our Website.Customers using Version 4.6 or higher can already use the integrated 'Check for update' function of WAGO Smart Script to update to Version 4.8.1.5.END UPDATE A2/2
- BehobenCisco Evolved Programmable Network Manager (EPNM)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - BehobenCisco Network Services Orchestratorcisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - BehobenCisco Unified Communications Manager / Cisco Unity Connectioncisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - BehobenCisco Unified Communications Manager IM and Presence Servicecisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - MitigationTraceAlertServerPLUSsiemens_psirt
Check file system permissions
- MitigationAdvantage Navigator Energy & Sustainabilitysiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationAdvantage Navigator Software Proxy V6siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationBuilding Operator Discovery Distribution for the Connect X200 Gatewaysiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationBuilding Operator Discovery Distribution for the Connect X300 Gatewaysiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationBuilding Twin - 360° Viewersiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationCOMOSsiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationCapital V2019.1siemens_psirt
Find detailed mitigation steps at: https://support.sw.siemens.com/en- US/knowledge-base/MG618363
- MitigationCapital V2020.1siemens_psirt
Find detailed mitigation steps at: https://support.sw.siemens.com/en- US/knowledge-base/MG618363
- MitigationCapital V2021.1siemens_psirt
Find detailed mitigation steps at: https://support.sw.siemens.com/en- US/knowledge-base/MG618363
- MitigationCerberus DMS V5.0siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationCerberus DMS V5.1siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationDesigo CC V3.0siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationDesigo CC V4.0siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationDesigo CC V4.1siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationDesigo CC V4.2siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationDesigo CC V5.0siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationDesigo CC V5.1siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationE-Car OC Cloud Applicationsiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationEnergy Engagesiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationEnergyIPsiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationEnlighted Amazesiemens_psirt
For Comfy and Enlighted, see also chapter Additional Information below
- MitigationEnlighted Wheresiemens_psirt
For Comfy and Enlighted, see also chapter Additional Information below
- MitigationGMA-Managersiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationGeolus Shape Search V10siemens_psirt
Find detailed remediation and mitigation information at: https://support.sw.siemens.com/en-US/knowledge-base/PL8601468
- MitigationGeolus Shape Search V11siemens_psirt
Find detailed remediation and mitigation information at: https://support.sw.siemens.com/en-US/knowledge-base/PL8601468
- MitigationHEEDS Connectsiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationHES UDISsiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationIndustrial Edge Hubsiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationIndustrial Edge Management App (IEM-App)siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationIndustrial Edge Management OS (IEM-OS)siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationMendix Applicationssiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationMindSphere App Management Cockpits (Developer& Operator)siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationMindSphere Asset Managersiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationMindSphere IAM (User Management/ Settings)siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationMindSphere Integrated Data Lakesiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationMindSphere Notification Servicesiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationMindSphere Predictive Learningsiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationMindSphere Usage Transparency Servicesiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationMindSphere Visual Explorersiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationMindsphere Cloud Foundrysiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationMindsphere Cloud Platformsiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationNX 1953 Seriessiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationNX 1980 Seriessiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationNX 2007 Seriessiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationNXpower Monitorsiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationOpcenter EX CP Process Automation Controlsiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationOpcenter Execution Core Process Automation Controlsiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationOpcenter Intelligencesiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationOperation Schedulersiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationSENTRON powermanager V4siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationSIGUARD DSAsiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationSIMATIC IPC1047siemens_psirt
Disable ports 8080/tcp and 8443/tcp in the firewall configuration of the IPC
- MitigationSIMATIC IPC1047Esiemens_psirt
Disable ports 8080/tcp and 8443/tcp in the firewall configuration of the IPC
- MitigationSIMATIC IPC647Dsiemens_psirt
Disable ports 8080/tcp and 8443/tcp in the firewall configuration of the IPC
- MitigationSIMATIC IPC647Esiemens_psirt
Disable ports 8080/tcp and 8443/tcp in the firewall configuration of the IPC
- MitigationSIMATIC IPC847Dsiemens_psirt
Disable ports 8080/tcp and 8443/tcp in the firewall configuration of the IPC
- MitigationSIMATIC IPC847Esiemens_psirt
Disable ports 8080/tcp and 8443/tcp in the firewall configuration of the IPC
- MitigationSiPass integrated V2.80siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationSiPass integrated V2.85siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationSimcenter 3Dsiemens_psirt
Find detailed remediation and mitigation information at: https://support.sw.siemens.com/en-US/knowledge-base/PL8601203
- MitigationSimcenter Amesimsiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationSimcenter System Architectsiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationSimcenter System Simulation Client for Gitsiemens_psirt
Find detailed mitigation steps for both server and client installations at: https://support.sw.siemens.com/en-US/knowledge- base/PL8602538
- MitigationSimcenter Testlabsiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationSimcenter Testlab Data Managementsiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationSiveillance Commandsiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationSiveillance Control Pro V2.1siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationSiveillance Control Pro V2.2siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationSiveillance Control Pro V2.3siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationSiveillance Identity V1.5siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationSiveillance Identity V1.6siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationSiveillance Vantagesiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationSolid Edge CAM Prosiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationSolid Edge Wiring and Harness Designsiemens_psirt
Find detailed mitigation steps at: https://support.sw.siemens.com/en- US/knowledge-base/MG618363
- MitigationSpectrum Power 4siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationSpectrum Power 7siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter Active Workspace V4.3siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter Active Workspace V5.0siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter Active Workspace V5.1siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter Active Workspace V5.2siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter Deployment Center V4.0siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter Deployment Center V4.1siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter Deployment Center V4.2siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter EDA V5.1siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter EDA V5.2siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter Integration Framework V13.0siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter Integration Framework V13.1siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter Integration Framework V13.2siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter Integration Framework V3.3siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter Integration Framework V4.0siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter Integration for CATIAsiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter MBSE Gateway V4.1siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter MBSE Gateway V4.2siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter MBSE Gateway V4.3siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter MBSE Gateway V5.0siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter MBSE Gateway V5.1siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter MBSE Gateway V5.2siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter Microservices Framework V5.1siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter Microservices Framework V5.2siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter Reporting and Analytics V11siemens_psirt
Find detailed remediation and mitigation information at: https://support.sw.siemens.com/en-US/knowledge-base/PL8600700
- MitigationTeamcenter Reporting and Analytics V12.2siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter Reporting and Analytics V12.3siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter Reporting and Analytics V12.4siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter Reporting and Analytics V13siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter Technical Publishingsiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter V12.1siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter V12.2siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter V12.3siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter V12.4siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter V13.0siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter V13.1siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter V13.2siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter V13.3siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTecnomatix Intositesiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTecnomatix Plant Simulationsiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTecnomatix Process Designersiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTecnomatix Process Simulatesiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTecnomatix Process Simulate VCLitesiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTecnomatix RobotExpertsiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTecnomatix eBOP Manager Serversiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationValor Parts Library - VPL Directsiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationValor Parts Library - VPL Server or Servicesiemens_psirt
Find detailed remediation and mitigation information at: https://support.sw.siemens.com/knowledge-base/MG618362
- MitigationVeSys V2019.1siemens_psirt
Find detailed mitigation steps at: https://support.sw.siemens.com/en- US/knowledge-base/MG618363
- MitigationVeSys V2020.1siemens_psirt
Find detailed mitigation steps at: https://support.sw.siemens.com/en- US/knowledge-base/MG618363
- MitigationVeSys V2021.1siemens_psirt
Find detailed mitigation steps at: https://support.sw.siemens.com/en- US/knowledge-base/MG618363
- MitigationXpedition Enterprise (XCR) VX.2.10siemens_psirt
Additional information is available at https://support.sw.siemens.com/en-US/product/1644094854/knowledge- base/MG618343
- MitigationXpedition Enterprise VX.2.10siemens_psirt
Additional information is available at https://support.sw.siemens.com/en-US/product/1644094854/knowledge- base/MG618343
- MitigationXpedition Enterprise VX.2.6siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationXpedition Enterprise VX.2.7siemens_psirt
Additional information is available at https://support.sw.siemens.com/en-US/product/1644094854/knowledge- base/MG618343
- MitigationXpedition Enterprise VX.2.8siemens_psirt
Additional information is available at https://support.sw.siemens.com/en-US/product/1644094854/knowledge- base/MG618343
- MitigationXpedition IC Packaging (XCR) VX.2.10siemens_psirt
Additional information is available at https://support.sw.siemens.com/en-US/product/1644094854/knowledge- base/MG618343
- MitigationXpedition IC Packaging VX.2.10siemens_psirt
Additional information is available at https://support.sw.siemens.com/en-US/product/1644094854/knowledge- base/MG618343
- MitigationXpedition IC Packaging VX.2.6siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationXpedition IC Packaging VX.2.7siemens_psirt
Additional information is available at https://support.sw.siemens.com/en-US/product/1644094854/knowledge- base/MG618343
- MitigationXpedition IC Packaging VX.2.8siemens_psirt
Additional information is available at https://support.sw.siemens.com/en-US/product/1644094854/knowledge- base/MG618343
- MitigationcRSPsiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationcRSP Operator Client Startersiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationjROS for Spectrum Power 4siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationjROS for Spectrum Power 7siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationSPPA-T3000 SeS3000 Security Server (6DU7054-0..00-..A0)siemens_psirt
Ensure that SPPA-T3000 is set up according to the security concept defined in the SPPA-T3000 security manual
- MitigationFirmware 4.2<4.8.1.4 installed on WAGO Smart Scriptwago_psirt
Do not use projects from untrusted sources. For further impact information and risk mitigation, see the recommendations of the Apache Foundation https://logging.apache.org/log4j/2.x/security.html Bundesamt für Sicherheit in der Informationstechnik (BSI) https://www.bsi.bund.de/DE/Service-Navi/Presse/Pressemitteilungen/Presse2021/211211_log4Shell_WarnstufeRot.html
- Kein Fix verfügbarTraceAlertServerPLUSsiemens_psirt
Currently no remediation is available
- Kein Fix verfügbarSPPA-T3000 SeS3000 Security Server (6DU7054-0..00-..A0)siemens_psirt
Currently no remediation is available
- Kein Fix geplantVeSys V2019.1siemens_psirt
Currently no fix is planned
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–critical · 5.1–9
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
ATT&CK-Techniken
ATT&CK-Techniken, die dies ermöglicht oder abbildet.
Exploits (12)
Öffentlicher Proof-of-Concept- und Exploit-Code.
- auxiliary/scanner/http/log4shell_scannerLog4Shell HTTP Scannerfunktional · metasploit
- BobTheShoplifter/CVE-2021-45046-InfoOh no another onePoC · poc_in_github
betroffene Produkte (269)
Betroffene Produkte und Versionsbereiche.
- Oracle Fusion Middleware 12.1.3.0.0alle Versionencert_bundDEcpe:/a:oracle:fusion_middleware:12.1.3.0.0
- Oracle Fusion Middleware 12.2.1.4.0alle Versionencert_bundDEcpe:/a:oracle:fusion_middleware:12.2.1.4.0
- Oracle Fusion Middleware 14.1.1.0.0alle Versionencert_bundDEcpe:/a:oracle:fusion_middleware:14.1.1.0.0
- Oracle Fusion Middleware 14.1.2.0.0alle Versionencert_bundDEcpe:/a:oracle:fusion_middleware:14.1.2.0.0
- Oracle Fusion Middleware 14.1.2.1.0alle Versionencert_bundDEcpe:/a:oracle:fusion_middleware:14.1.2.1.0
- Oracle Fusion Middleware 15.1.1.0.0alle Versionencert_bundDEcpe:/a:oracle:fusion_middleware:15.1.1.0.0
Advisories (10)
Hersteller- und Ökosystem-Meldungen dazu.
- SSA-397453SSA-397453: Apache Log4j Vulnerabilities (Log4Shell, CVE-2021-44228, CVE-2021-45046) - Impact to Siemens Energy TraceAlertServerPLUS2021-12-20csaf · siemens_psirtDE
On 2021-12-09, a vulnerability in Apache Log4j (a logging library used in many Java-based applications) was disclosed, that could allow remote unauthenticated attackers to execute code on vulnerable systems. The vulnerability is tracked as CVE-2021-44228 and is also known as "Log4Shell". On 2021-12-14 an additional denial of service vulnerability (CVE-2021-45046) was published rendering the initial mitigations and fix in version 2.15.0 as incomplete under certain non-default configurations. Log4j versions 2.16.0 and 2.12.2 are supposed to fix both vulnerabilities. On 2021-12-17, CVE-2021-45046 was reclassified with an increased CVSS base score (from 3.7 to 9.0). The potential impact of CVE-2021-45046 now includes - besides denial of service - also information disclosure and local (and potential remote) code execution. Siemens Energy is preparing updates and recommends specific countermeasures for TraceAlertServerPLUS.
- SSA-479842SSA-479842: Apache Log4j Vulnerabilities - Impact to Siemens Energy Sensformer / Sensgear (Platform, Basic and Advanced)2021-12-21csaf · siemens_psirtDE
On 2021-12-09, a vulnerability in Apache Log4j (a logging tool used in many Java-based applications) was disclosed, that could allow remote unauthenticated attackers to execute code on vulnerable systems. The vulnerability is tracked as CVE-2021-44228 and is also known as "Log4Shell". On 2021-12-14 an additional denial of service vulnerability (CVE-2021-45046) was published rendering the initial mitigations and fix in version 2.15.0 as incomplete under certain non-default configurations. Log4j versions 2.16.0 and 2.12.2 are supposed to fix both vulnerabilities. On 2021-12-17, CVE-2021-45046 was reclassified with an increased CVSS base score (from 3.7 to 9.0). The potential impact of CVE-2021-45046 now includes - besides denial of service - also information disclosure and local (and potential remote) code execution. Furthermore, one additional denial of service vulnerability, CVE-2021-45105, was disclosed. The Siemens Energy Sensformer / Sensgear cloud service was affected by these vulnerabilities and has remediated them. No user actions are necessary.
- SSA-661247SSA-661247: Apache Log4j Vulnerabilities (Log4Shell, CVE-2021-44228, CVE-2021-45046) - Impact to Siemens Products2021-12-13csaf · siemens_psirtDE
On 2021-12-09, a vulnerability in Apache Log4j (a logging tool used in many Java-based applications) was disclosed, that could allow remote unauthenticated attackers to execute code on vulnerable systems. The vulnerability is tracked as CVE-2021-44228 and is also known as "Log4Shell". On 2021-12-14 an additional denial of service vulnerability (CVE-2021-45046) was published rendering the initial mitigations and fix in version 2.15.0 as incomplete under certain non- default configurations. Log4j versions 2.16.0 and 2.12.2 are supposed to fix both vulnerabilities. On 2021-12-17, CVE-2021-45046 was reclassified with an increased CVSS base score (from 3.7 to 9.0). The potential impact of CVE-2021-45046 now includes - besides denial of service - also information disclosure and local (and potential remote) code execution. Siemens is currently investigating to determine which products are affected and is continuously updating this advisory as more information becomes available. See section Additional Information for more details regarding the investigation status. Note: two additional vulnerabilities were published for Apache Log4j, the impact of which are documented in SSA-501673: https://cert- portal.siemens.com/productcert/pdf/ssa-501673.pdf (CVE-2021-45105) and SSA-784507: https://cert- portal.siemens.com/productcert/pdf/ssa-784507.pdf (CVE-2021-44832).
- SSA-714170SSA-714170: Apache Log4j Vulnerabilities (Log4Shell, CVE-2021-44228, CVE-2021-45046) - Impact to SPPA-T30002021-12-16csaf · siemens_psirtDE
On 2021-12-09, a vulnerability in Apache Log4j (a logging library used in many Java-based applications) was disclosed, that could allow remote unauthenticated attackers to execute code on vulnerable systems. The vulnerability is tracked as CVE-2021-44228 and is also known as "Log4Shell". On 2021-12-14 an additional denial of service vulnerability (CVE-2021-45046) was published rendering the initial mitigations and fix in version 2.15.0 as incomplete under certain non-default configurations. Log4j versions 2.16.0 and 2.12.2 are supposed to fix both vulnerabilities. On 2021-12-17, CVE-2021-45046 was reclassified with an increased CVSS base score (from 3.7 to 9.0). The potential impact of CVE-2021-45046 now includes - besides denial of service - also information disclosure and local (and potential remote) code execution. Siemens Energy is preparing updates and recommends specific countermeasures for SPPA-T3000.
- VDE-2021-060WAGO: Smart Script affected by Log4Shell Vulnerability2022-01-05csaf · wago_psirtDE
Apache Log4j is used for logging events in WAGO Smart Script in Version 4.2 and higher. Events logged by Log4j can contain JNDI references. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. Additionally, Log4j does not protect from self-referential lookups, which can lead to Denial of Service. UPDATE A1/2: Affected versions: CVE-2021-44228 and CVE-2021-45046: WAGO Smart Script >= Version 4.2 and < Version 4.8.1.3 CVE-2021-45105: WAGO Smart Script >= Version 4.2 and < Version 4.8.1.4 CVE-2021-44832 WAGO Smart Script >= Version 4.2 and < Version 4.8.1.5 END UPDATE A1/2
- WID-SEC-W-2022-0352Apache log4j: Schwachstelle ermöglicht CodeausführungDeutsch2021-12-14csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Apache log4j ausnutzen, um beliebigen Code auszuführen.
- WID-SEC-W-2023-0063Juniper Junos Space: Mehrere SchwachstellenDeutsch2022-01-12csaf · cert_bundDE
Ein Angreifer aus dem angrenzenden Netzwerk oder ein entfernter anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in Juniper Junos Space ausnutzen, um Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand auszulösen, beliebigen Code auszuführen und seine Privilegien zu erweitern.
- WID-SEC-W-2026-1203Oracle Fusion Middleware: Mehrere SchwachstellenDeutsch2026-04-21csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Fusion Middleware ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- cisco-sa-apache-log4j-qRuKNEbdVulnerabilities in Apache Log4j Library Affecting Cisco Products: December 20212021-12-10csaf · cisco_csafUS
Critical Vulnerabilities in Apache Log4j Java Logging Library On December 9, 2021, the following critical vulnerability in the Apache Log4j Java logging library affecting all Log4j2 versions earlier than 2.15.0 was disclosed: CVE-2021-44228: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints On December 14, 2021, the following critical vulnerability, which affects certain Apache Log4j use cases in versions 2.15.0 and earlier, was disclosed: CVE-2021-45046: Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack On December 18, 2021, a vulnerability in the Apache Log4j component affecting versions 2.16 and earlier was disclosed: CVE-2021-45105: Apache Log4j2 does not always protect from infinite recursion in lookup evaluation On December 28, 2021, a vulnerability in the Apache Log4j component affecting versions 2.17 and earlier was disclosed: CVE-2021-44832: Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration For a description of these vulnerabilities, see the Apache Log4j Security Vulnerabilities ["https://logging.apache.org/log4j/2.x/security.html"] page. Cisco's Response to These Vulnerabilities Cisco assessed all products and services for impact from both CVE-2021-44228 and CVE-2021-45046. To help detect exploitation of these vulnerabilities, Cisco has released Snort rules at the following location: Talos Rules 2021-12-21 ["https://www.snort.org/advisories/talos-rules-2021-12-21"] Product fixes that are listed in this advisory will address both CVE-2021-44228 and CVE-2021-45046 unless otherwise noted. Cisco has reviewed CVE-2021-45105 and CVE-2021-44832 and has determined that no Cisco products or cloud offerings are impacted by these vulnerabilities. Cisco's standard practice is to update integrated third-party software components to later versions as they become available.
- GHSA-7rjr-3q55-vv33Incomplete fix for Apache Log4j vulnerability2021-12-14ghsa · osvUS
# Impact The fix to address [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allow attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in a remote code execution (RCE) attack. ## Affected packages Only the `org.apache.logging.log4j:log4j-core` package is directly affected by this vulnerability. The `org.apache.logging.log4j:log4j-api` should be kept at the same version as the `org.apache.logging.log4j:log4j-core` package to ensure compatability if in use. # Mitigation Log4j 2.16.0 fixes this issue by removing support for message lookup patterns and disabling JNDI functionality by default. This issue can be mitigated in prior releases (< 2.16.0) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). Log4j 2.15.0 restricts JNDI LDAP lookups to localhost by default. Note that previous mitigations involving configuration such as to set the system property `log4j2.formatMsgNoLookups` to `true` do NOT mitigate this specific vulnerability.
auch bekannt als (4)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (128)
Externe Belege — Patches, Meldungen, Analysen.
- http://www.openwall.com/lists/oss-security/2021/12/14/4cnnvd
- http://www.openwall.com/lists/oss-security/2021/12/15/3cnnvd
- http://www.openwall.com/lists/oss-security/2021/12/18/1cnnvd
- https://access.redhat.com/security/cve/cve-2021-45046cnnvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdfcnnvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdfcnnvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdfcnnvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdfcnnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan