CVE-2021-31894
highpriority · track · 35EPSS 0.002 · 13 %ileDEEUUSEPSS · scored 2026-10-27
A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.X (All versions < V9.1 SP2), SIMATIC PDM (All versions < V9.2 SP2), SIMATIC STEP 7 V5.X (All versions < V5.7), SINAMICS STARTER (containing STEP 7 OEM version) (All versions < V5.4 SP2 HF1). A directory containing metafiles relevant to devices' configurations has write permissions. An attacker could leverage this vulnerability by changing the content of certain metafiles and subsequently manipulate parameters or behavior of devices that would be later configured by the affected software.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedSIMATIC PCS 7 V9.Xsiemens_psirt
Update to V9.1 SP2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812240/ - FixedSIMATIC PDMsiemens_psirt
Update to V9.2 SP2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109811911/ - FixedSIMATIC STEP 7 V5.Xsiemens_psirt
Update to V5.7 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794088/ - FixedSINAMICS STARTER (containing STEP 7 OEM version)siemens_psirt
Update to V5.4 SP2 HF1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109800526/ - FixedSIMATIC PCS 7 V9.Xcisa_csaf_ot
Update to V9.1 SP2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812240/ - FixedSIMATIC PDMcisa_csaf_ot
Update to V9.2 SP2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109811911/ - FixedSIMATIC STEP 7 V5.Xcisa_csaf_ot
Update to V5.7 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794088/ - FixedSINAMICS STARTER (containing STEP 7 OEM version)cisa_csaf_ot
Update to V5.4 SP2 HF1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109800526/ - MitigationSIMATIC PCS 7 V8.2 and earliersiemens_psirt
Restrict access on the engineering station to trusted users only
- MitigationSIMATIC PCS 7 V9.Xsiemens_psirt
Restrict access on the engineering station to trusted users only
- MitigationSIMATIC PDMsiemens_psirt
Restrict access on the engineering station to trusted users only
- MitigationSIMATIC STEP 7 V5.Xsiemens_psirt
Restrict access on the engineering station to trusted users only
- MitigationSINAMICS STARTER (containing STEP 7 OEM version)siemens_psirt
Restrict access on the engineering station to trusted users only
- MitigationSIMATIC PCS 7 V8.2 and earliercisa_csaf_ot
Restrict access on the engineering station to trusted users only
- MitigationSIMATIC PCS 7 V9.Xcisa_csaf_ot
Restrict access on the engineering station to trusted users only
- MitigationSIMATIC PDMcisa_csaf_ot
Restrict access on the engineering station to trusted users only
- MitigationSIMATIC STEP 7 V5.Xcisa_csaf_ot
Restrict access on the engineering station to trusted users only
- MitigationSINAMICS STARTER (containing STEP 7 OEM version)cisa_csaf_ot
Restrict access on the engineering station to trusted users only
- No fix plannedSIMATIC PCS 7 V8.2 and earliersiemens_psirt
Currently no fix is planned
- No fix plannedSIMATIC PCS 7 V8.2 and earliercisa_csaf_ot
Currently no fix is planned
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (26)
Products and version ranges known to be affected.
- siemens simatic step 7 firmware5.0 → 5.7nvdUScpe:2.3:o:siemens:simatic_step_7_firmware:*:*:*:*:*:*:*:*
- siemens sinamics starter firmware< 5.4nvdUScpe:2.3:o:siemens:sinamics_starter_firmware:*:*:*:*:*:*:*:*
advisories (2)
Vendor and ecosystem advisories describing this.
- SSA-661034SSA-661034: Incorrect Permission Assignment in Multiple SIMATIC Software Products2021-07-13csaf · siemens_psirtDE
Multiple SIMATIC software products are affected by a vulnerability that could allow an attacker to change the content of certain metafiles and subsequently manipulate parameters or behaviour of devices configured by the affected software products. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens is preparing further updates and recommends specific countermeasures for products where updates are not, or not yet available.
- ICSA-21-194-06Siemens SIMATIC Software Products (Update B)2021-07-13icsa · cisa_csaf_otUS
Multiple SIMATIC software products are affected by a vulnerability that could allow an attacker to change the content of certain metafiles and subsequently manipulate parameters or behaviour of devices configured by the affected software products. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens is preparing further updates and recommends specific countermeasures for products where updates are not, or not yet available.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (7)
External citations — patches, advisories, analysis.
- https://cert-portal.siemens.com/productcert/pdf/ssa-661034.pdfcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2021-31894cnnvd
- https://vigilance.fr/vulnerability/Siemens-SIMATIC-privilege-escalation-via-metafiles-35868cnnvd
- https://www.auscert.org.au/bulletins/ESB-2021.2399cnnvd
- https://www.cybersecurity-help.cz/vdb/SB2021071421cnnvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-661034.pdfenisa_euvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-661034.pdfPatchVendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan