CVE-2021-31893

highpriority · track · 31EPSS 0.006 · 47 %ileDEEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.56% (47th) EPSS

CVSS 7.2 · high

Is it mine?

26 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · cisa_csaf_ot · nvd

EPSS · scored 2026-10-27

A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3), SIMATIC PDM (All versions < V9.2), SIMATIC STEP 7 V5.X (All versions < V5.6 SP2 HF3), SINAMICS STARTER (containing STEP 7 OEM version) (All versions < V5.4 HF2). The affected software contains a buffer overflow vulnerability while handling certain files that could allow a local attacker to trigger a denial-of-service condition or potentially lead to remote code execution.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedSIMATIC PCS 7 V9.0siemens_psirt
Update to V9.0 SP3 or later version
FixedSIMATIC PDMsiemens_psirt
Update to V9.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794361/
FixedSIMATIC STEP 7 V5.Xsiemens_psirt
Update to V5.6 SP2 HF3 or later version
https://support.industry.siemens.com/cs/de/en/view/109779992/
FixedSINAMICS STARTER (containing STEP 7 OEM version)siemens_psirt
Update to V5.4 HF2 or later version
https://support.industry.siemens.com/cs/us/en/view/109782792/
FixedSIMATIC PCS 7 V9.0cisa_csaf_ot
Update to V9.0 SP3 or later version
FixedSIMATIC PDMcisa_csaf_ot
Update to V9.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794361/
FixedSIMATIC STEP 7 V5.Xcisa_csaf_ot
Update to V5.6 SP2 HF3 or later version
https://support.industry.siemens.com/cs/de/en/view/109779992/
FixedSINAMICS STARTER (containing STEP 7 OEM version)cisa_csaf_ot
Update to V5.4 HF2 or later version
https://support.industry.siemens.com/cs/us/en/view/109782792/
WorkaroundSIMATIC PCS 7 V8.2 and earliersiemens_psirt
Only use project files from trusted sources
WorkaroundSIMATIC PCS 7 V9.0siemens_psirt
Only use project files from trusted sources
WorkaroundSIMATIC PDMsiemens_psirt
Only use project files from trusted sources
WorkaroundSIMATIC STEP 7 V5.Xsiemens_psirt
Only use project files from trusted sources
WorkaroundSINAMICS STARTER (containing STEP 7 OEM version)siemens_psirt
Only use project files from trusted sources
WorkaroundSIMATIC PCS 7 V8.2 and earliercisa_csaf_ot
Only use project files from trusted sources
WorkaroundSIMATIC PCS 7 V9.0cisa_csaf_ot
Only use project files from trusted sources
WorkaroundSIMATIC PDMcisa_csaf_ot
Only use project files from trusted sources
WorkaroundSIMATIC STEP 7 V5.Xcisa_csaf_ot
Only use project files from trusted sources
WorkaroundSINAMICS STARTER (containing STEP 7 OEM version)cisa_csaf_ot
Only use project files from trusted sources
No fix availableSIMATIC PCS 7 V8.2 and earliersiemens_psirt
Currently no remediation is available
No fix availableSIMATIC PCS 7 V8.2 and earliercisa_csaf_ot
Currently no remediation is available

cvss

Technical severity, 0–10. One row per scoring source.

7.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v2.07.2highAV:L/AC:L/Au:N/C:C/I:C/A:Cprimary · NVD / NIST USexploitability 3.9 · impact 10

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 1.8 · impact 5.9

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:Csecondary · CISA US

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:Csecondary · Siemens ProductCERT DE

v3.17.1highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-120USCWE-120USCWE-120US

affected products (26)

Products and version ranges known to be affected.

SIMATIC PCS 7 V8.2 and earlierall versionscisa_csaf_otUS
SIMATIC PCS 7 V9.0all versionscisa_csaf_otUS
SIMATIC PDMall versionscisa_csaf_otUS
SIMATIC STEP 7 V5.Xall versionscisa_csaf_otUS
SINAMICS STARTER (containing STEP 7 OEM version)all versionscisa_csaf_otUS
Siemens SIMATIC PCS 7 V8.2 and earlier≤ vers:all/*cisa_csaf_otUS
Siemens SIMATIC PCS 7 V9.0< V9.0_SP3cisa_csaf_otUS
Siemens SIMATIC PDM< V9.2cisa_csaf_otUS
Siemens SIMATIC STEP 7 V5.X< V5.6_SP2_HF3cisa_csaf_otUS
Siemens SINAMICS STARTER (containing STEP 7 OEM version)< V5.4_HF2cisa_csaf_otUS
Siemens SIMATIC PCS 7 V8.2 and earlier≤ All versionsenisa_euvdEU
Siemens SIMATIC PCS 7 V9.0All versions → V9.0 SP3enisa_euvdEU
Siemens SIMATIC PDMAll versions → V9.2enisa_euvdEU
Siemens SIMATIC STEP 7 V5.XAll versions → V5.6 SP2 HF3enisa_euvdEU
Siemens SINAMICS STARTER (containing STEP 7 OEM version)All versions → V5.4 HF2enisa_euvdEU
siemens simatic pcs firmware≤ 8.2nvdUScpe:2.3:o:siemens:simatic_pcs_firmware:*:*:*:*:*:*:*:*
siemens simatic pcs firmware= 9.0nvdUScpe:2.3:o:siemens:simatic_pcs_firmware:*:*:*:*:*:*:*:*
siemens simatic pdm firmware< 9.2nvdUScpe:2.3:o:siemens:simatic_pdm_firmware:*:*:*:*:*:*:*:*
siemens simatic step 7 firmware≤ 5.6nvdUScpe:2.3:o:siemens:simatic_step_7_firmware:*:*:*:*:*:*:*:*
siemens sinamics starter firmware< 5.4nvdUScpe:2.3:o:siemens:sinamics_starter_firmware:*:*:*:*:*:*:*:*

showing 20 of 26

advisories (2)

Vendor and ecosystem advisories describing this.

SSA-641963SSA-641963: Remote Code Execution Vulnerability in Multiple SIMATIC Software Products2021-07-13csaf · siemens_psirtDE
Multiple SIMATIC Software products are affected by a vulnerability that could allow an attacker to manipulate project files and remotely execute code. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available.
ICSA-21-194-05Siemens SIMATIC Software Products2021-07-13icsa · cisa_csaf_otUS
Multiple SIMATIC Software products are affected by a vulnerability that could allow an attacker to manipulate project files and remotely execute code. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cisa_csaf_ot nvd siemens_psirt NVD CVE.org MITRE

published 2021-07-13modified 2026-06-17

references (7)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan