CVE-2021-46304

highPriorität · verfolgen · 30EPSS 0.007 · 52. PerzentilDEEURUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
0.68% (52nd) EPSS
CVSS 7.5 · high
Is it mine?
23 products
Prüfe deine Angriffsfläche
Who says so?
6 sources
cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · bewertet 2026-10-24

A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions), CP-8000 MASTER MODULE WITH I/O -40/+70°C (All versions), CP-8021 MASTER MODULE (All versions), CP-8022 MASTER MODULE WITH GPRS (All versions). The component allows to activate a web server module which provides unauthenticated access to its web pages. This could allow an attacker to retrieve debug-level information from the component such as internal network topology or connected systems.

01

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Noch kein Hersteller-Fix; eine Mitigation ist verfügbar.

  • MitigationCP-8000 MASTER MODULE WITH I/O -25/+70°Csiemens_psirt

    Operate the affected web server module only when required and consider the security instructions provided in the updated manual (see also Additional Information chapter)

  • MitigationCP-8000 MASTER MODULE WITH I/O -40/+70°Csiemens_psirt

    Operate the affected web server module only when required and consider the security instructions provided in the updated manual (see also Additional Information chapter)

  • MitigationCP-8021 MASTER MODULEsiemens_psirt

    Operate the affected web server module only when required and consider the security instructions provided in the updated manual (see also Additional Information chapter)

  • MitigationCP-8022 MASTER MODULE WITH GPRSsiemens_psirt

    Operate the affected web server module only when required and consider the security instructions provided in the updated manual (see also Additional Information chapter)

  • MitigationCP-8000 MASTER MODULE WITH I/O -25/+70°Ccisa_csaf_ot

    Operate the affected web server module only when required and consider the security instructions provided in the updated manual (see also Additional Information chapter)

  • MitigationCP-8000 MASTER MODULE WITH I/O -40/+70°Ccisa_csaf_ot

    Operate the affected web server module only when required and consider the security instructions provided in the updated manual (see also Additional Information chapter)

  • MitigationCP-8021 MASTER MODULEcisa_csaf_ot

    Operate the affected web server module only when required and consider the security instructions provided in the updated manual (see also Additional Information chapter)

  • MitigationCP-8022 MASTER MODULE WITH GPRScisa_csaf_ot

    Operate the affected web server module only when required and consider the security instructions provided in the updated manual (see also Additional Information chapter)

  • Kein Fix geplantCP-8000 MASTER MODULE WITH I/O -25/+70°Csiemens_psirt

    Currently no fix is planned

  • Kein Fix geplantCP-8000 MASTER MODULE WITH I/O -40/+70°Csiemens_psirt

    Currently no fix is planned

  • Kein Fix geplantCP-8021 MASTER MODULEsiemens_psirt

    Currently no fix is planned

  • Kein Fix geplantCP-8022 MASTER MODULE WITH GPRSsiemens_psirt

    Currently no fix is planned

  • Kein Fix geplantCP-8000 MASTER MODULE WITH I/O -25/+70°Ccisa_csaf_ot

    Currently no fix is planned

  • Kein Fix geplantCP-8000 MASTER MODULE WITH I/O -40/+70°Ccisa_csaf_ot

    Currently no fix is planned

  • Kein Fix geplantCP-8021 MASTER MODULEcisa_csaf_ot

    Currently no fix is planned

  • Kein Fix geplantCP-8022 MASTER MODULE WITH GPRScisa_csaf_ot

    Currently no fix is planned

02

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

7.5
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 4.3–7.5

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 3.6
v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:Csecondary · CISA US
v3.16.5mediumAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:Nsecondary · FSTEC (BDU) RU
v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Nsecondary · ENISA EU
v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NsecondaryAusnutzbarkeit 3.9 · Auswirkung 1.4
v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:Csecondary · Siemens ProductCERT DE
v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)
03

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Trackcoordinatorcisa_ssvcUS
04

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-284USCWE-284USCWE-284USCWE-284US
05

betroffene Produkte (23)

Betroffene Produkte und Versionsbereiche.

20 von 23 angezeigt
06

Advisories (2)

Hersteller- und Ökosystem-Meldungen dazu.

  • SSA-185638SSA-185638: Authentication Bypass Vulnerability in SICAM A8000 Web Server Module2022-08-09csaf · siemens_psirtDE

    A vulnerability was identified in the web server module used in the SICAM A8000 CP-8000, CP-8021 and CP-8022 devices' protocol firmwares. - AGPMT0 (AGP Master) - DNPiT1 (DNP3 TCP/IP Server) - DNPiT2 (DNP3 TCP/IP Client) - DNPMT0 (DNP3 Master seriell) - DNPST0 (DNP3 Slave seriell) - ET83 (61850 Ed.1) - ET85 (61850 Ed.2) - MBCiT0 (MODBUS TCP/IP Client) - MBSiT0 (MODBUS TCP/IP Server) - MODMT2 (MODBUS Master seriell) - OPUPT0 (OPCUA Pub/Sub) - OPUPT1 (Mindconnect) The vulnerability could allow unauthenticated access to the web interface of the affected web server module. The module is used for diagnostic purposes as well as commissioning and has to be activated manually within the protocol firmwares. For this reason the protocol firmwares are secure by default. Siemens updated the manual to make the situation transparent and raise awareness for operators. Siemens recommends countermeasures for products where updates are not, or not yet available.

  • ICSA-22-223-05Siemens SICAM A8000 Web Server Module2022-08-09icsa · cisa_csaf_otUS

    A vulnerability was identified in the web server module used in the SICAM A8000 CP-8000, CP-8021 and CP-8022 devices' protocol firmwares. - AGPMT0 (AGP Master) - DNPiT1 (DNP3 TCP/IP Server) - DNPiT2 (DNP3 TCP/IP Client) - DNPMT0 (DNP3 Master seriell) - DNPST0 (DNP3 Slave seriell) - ET83 (61850 Ed.1) - ET85 (61850 Ed.2) - MBCiT0 (MODBUS TCP/IP Client) - MBSiT0 (MODBUS TCP/IP Server) - MODMT2 (MODBUS Master seriell) - OPUPT0 (OPCUA Pub/Sub) - OPUPT1 (Mindconnect) The vulnerability could allow unauthenticated access to the web interface of the affected web server module. The module is used for diagnostic purposes as well as commissioning and has to be activated manually within the protocol firmwares. For this reason the protocol firmwares are secure by default. Siemens updated the manual to make the situation transparent and raise awareness for operators. Siemens recommends countermeasures for products where updates are not, or not yet available.

07

auch bekannt als (4)

Weitere Namen und Kennungen dieser Entität.

08

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvdenisa_euvdfstec_bducisa_csaf_otnvdsiemens_psirtNVDCVE.orgMITRE
veröffentlicht 2022-08-10geändert 2026-06-17
09

Referenzen (6)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan