CVE-2021-40364

lowpriority · track · 8EPSS 0.002 · 14 %ileDEEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.24% (14th) EPSS

CVSS 2.1 · low

Is it mine?

40 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · cisa_csaf_ot · siemens_psirt

EPSS · scored 2026-10-22

A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC04), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMATIC WinCC V15 and earlier (All versions < V15 SP1 Update 7), SIMATIC WinCC V16 (All versions < V16 Update 5), SIMATIC WinCC V17 (All versions < V17 Update 2), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 19), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 5). The affected systems store sensitive information in log files. An attacker with access to the log files could publicly expose the information or reuse it to develop further attacks on the system.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedSIMATIC PCS 7 V8.2siemens_psirt
Update to V8.2 SP1; then update SIMATIC WinCC to V7.4 SP1 Update 19 or later version to fix CVE-2021-40358 and CVE-2021-40364
https://support.industry.siemens.com/cs/ww/en/view/109806846/
FixedSIMATIC PCS 7 V9.0siemens_psirt
Update to V9.0 SP3 UC04 or later version to fix CVE-2021-40358 and CVE-2021-40364
https://support.industry.siemens.com/cs/ww/en/view/109780528/
FixedSIMATIC PCS 7 V9.1siemens_psirt
Update to V9.1 SP1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109805073/
FixedSIMATIC WinCC V15 and earliersiemens_psirt
Update to V15 SP1 Update 7 or later version
https://support.industry.siemens.com/cs/us/en/view/109763890/
FixedSIMATIC WinCC V16siemens_psirt
Update to V16 Update 5 or later version
https://support.industry.siemens.com/cs/ww/en/view/109776017/
FixedSIMATIC WinCC V17siemens_psirt
Update to V17 Update 2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109784441/
FixedSIMATIC WinCC V7.4siemens_psirt
Update to V7.4 SP1 Update 19 or later version
https://support.industry.siemens.com/cs/ww/en/view/109806846/
FixedSIMATIC WinCC V7.5siemens_psirt
Update to V7.5 SP2 Update 5 or later version
https://support.industry.siemens.com/cs/ww/en/view/109793460/
FixedSIMATIC PCS 7 V8.2cisa_csaf_ot
Update to V8.2 SP1; then update SIMATIC WinCC to V7.4 SP1 Update 19 or later version to fix CVE-2021-40358 and CVE-2021-40364
https://support.industry.siemens.com/cs/ww/en/view/109806846/
FixedSIMATIC PCS 7 V9.0cisa_csaf_ot
Update to V9.0 SP3 UC04 or later version to fix CVE-2021-40358 and CVE-2021-40364
https://support.industry.siemens.com/cs/ww/en/view/109780528/
FixedSIMATIC PCS 7 V9.1cisa_csaf_ot
Update to V9.1 SP1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109805073/
FixedSIMATIC WinCC V15 and earliercisa_csaf_ot
Update to V15 SP1 Update 7 or later version
https://support.industry.siemens.com/cs/us/en/view/109763890/
FixedSIMATIC WinCC V16cisa_csaf_ot
Update to V16 Update 5 or later version
https://support.industry.siemens.com/cs/ww/en/view/109776017/
FixedSIMATIC WinCC V17cisa_csaf_ot
Update to V17 Update 2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109784441/
FixedSIMATIC WinCC V7.4cisa_csaf_ot
Update to V7.4 SP1 Update 19 or later version
https://support.industry.siemens.com/cs/ww/en/view/109806846/
FixedSIMATIC WinCC V7.5cisa_csaf_ot
Update to V7.5 SP2 Update 5 or later version
https://support.industry.siemens.com/cs/ww/en/view/109793460/
MitigationSIMATIC PCS 7 V8.2siemens_psirt
CVE-2021-40364: Harden the application’s host to prevent local access by untrusted personnel
MitigationSIMATIC PCS 7 V9.0siemens_psirt
CVE-2021-40364: Harden the application’s host to prevent local access by untrusted personnel
MitigationSIMATIC PCS 7 V9.1siemens_psirt
CVE-2021-40364: Harden the application’s host to prevent local access by untrusted personnel
MitigationSIMATIC WinCC V15 and earliersiemens_psirt
CVE-2021-40364: Harden the application’s host to prevent local access by untrusted personnel
MitigationSIMATIC WinCC V16siemens_psirt
CVE-2021-40364: Harden the application’s host to prevent local access by untrusted personnel
MitigationSIMATIC WinCC V17siemens_psirt
CVE-2021-40364: Harden the application’s host to prevent local access by untrusted personnel
MitigationSIMATIC WinCC V7.4siemens_psirt
CVE-2021-40364: Harden the application’s host to prevent local access by untrusted personnel
MitigationSIMATIC WinCC V7.5siemens_psirt
CVE-2021-40364: Harden the application’s host to prevent local access by untrusted personnel
MitigationSIMATIC PCS 7 V8.2cisa_csaf_ot
CVE-2021-40364: Harden the application’s host to prevent local access by untrusted personnel
MitigationSIMATIC PCS 7 V9.0cisa_csaf_ot
CVE-2021-40364: Harden the application’s host to prevent local access by untrusted personnel
MitigationSIMATIC PCS 7 V9.1cisa_csaf_ot
CVE-2021-40364: Harden the application’s host to prevent local access by untrusted personnel
MitigationSIMATIC WinCC V15 and earliercisa_csaf_ot
CVE-2021-40364: Harden the application’s host to prevent local access by untrusted personnel
MitigationSIMATIC WinCC V16cisa_csaf_ot
CVE-2021-40364: Harden the application’s host to prevent local access by untrusted personnel
MitigationSIMATIC WinCC V17cisa_csaf_ot
CVE-2021-40364: Harden the application’s host to prevent local access by untrusted personnel
MitigationSIMATIC WinCC V7.4cisa_csaf_ot
CVE-2021-40364: Harden the application’s host to prevent local access by untrusted personnel
MitigationSIMATIC WinCC V7.5cisa_csaf_ot
CVE-2021-40364: Harden the application’s host to prevent local access by untrusted personnel

cvss

Technical severity, 0–10. One row per scoring source.

5.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 1.8–5.5

v2.02.1lowAV:L/AC:L/Au:N/C:P/I:N/A:Nprimary · NVD / NIST USexploitability 3.9 · impact 2.9

v2.01.8lowAV:L/AC:L/Au:N/C:P/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

v3.15.5mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:Csecondary · CISA US

v3.15.5mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Nsecondary · productcert@siemens.com DEexploitability 1.8 · impact 3.6

v3.15.5mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:Csecondary · Siemens ProductCERT DE

v3.15.5mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:Csecondary · ENISA EU

v3.15.5mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Nsecondary · NVD / NIST USexploitability 1.8 · impact 3.6

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-532USCWE-532USCWE-532US

affected products (40)

Products and version ranges known to be affected.

SIMATIC PCS 7 V8.2all versionscisa_csaf_otUS
SIMATIC PCS 7 V9.0all versionscisa_csaf_otUS
SIMATIC PCS 7 V9.1all versionscisa_csaf_otUS
SIMATIC WinCC V15 and earlierall versionscisa_csaf_otUS
SIMATIC WinCC V16all versionscisa_csaf_otUS
SIMATIC WinCC V17all versionscisa_csaf_otUS
SIMATIC WinCC V7.4all versionscisa_csaf_otUS
SIMATIC WinCC V7.5all versionscisa_csaf_otUS
Siemens SIMATIC PCS 7 V8.2≤ vers:all/*cisa_csaf_otUS
Siemens SIMATIC PCS 7 V9.0< V9.0_SP3_UC04cisa_csaf_otUS
Siemens SIMATIC PCS 7 V9.1< V9.1_SP1cisa_csaf_otUS
Siemens SIMATIC WinCC V15 and earlier< V15_SP1_Update_7cisa_csaf_otUS
Siemens SIMATIC WinCC V16< V16_Update_5cisa_csaf_otUS
Siemens SIMATIC WinCC V17< V17_Update_2cisa_csaf_otUS
Siemens SIMATIC WinCC V7.4< V7.4_SP1_Update_19cisa_csaf_otUS
Siemens SIMATIC WinCC V7.5< V7.5_SP2_Update_5cisa_csaf_otUS
Siemens SIMATIC PCS 7 V8.2≤ All versionsenisa_euvdEU
Siemens SIMATIC PCS 7 V9.0All versions → V9.0 SP3 UC04enisa_euvdEU
Siemens SIMATIC PCS 7 V9.1All versions → V9.1 SP1enisa_euvdEU
Siemens SIMATIC WinCC V15 and earlierAll versions → V15 SP1 Update 7enisa_euvdEU

showing 20 of 40

advisories (2)

Vendor and ecosystem advisories describing this.

SSA-840188SSA-840188: Multiple Vulnerabilities in SIMATIC WinCC Affecting Other SIMATIC Software Products2021-11-09csaf · siemens_psirtDE
Multiple vulnerabilities were found in SIMATIC WinCC that ultimately could allow local or remote attackers to escalate privileges and read, write or delete critical files. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available. Note: The vulnerability CVE-2021-40359 is part of a shared component, used by various Siemens products (SIMATIC Communication Services - SCS). The installation of a fix version of any product also removes the vulnerability for other products on the same system, even if those products were not updated.
ICSA-21-315-03Siemens SIMATIC WinCC (Update E)2021-11-09icsa · cisa_csaf_otUS
Multiple vulnerabilities were found in SIMATIC WinCC that ultimately could allow local or remote attackers to escalate privileges and read, write or delete critical files. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available. Note: The vulnerability CVE-2021-40359 is part of a shared component, used by various Siemens products (SIMATIC Communication Services - SCS). The installation of a fix version of any product also removes the vulnerability for other products on the same system, even if those products were not updated.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cisa_csaf_ot siemens_psirt NVD CVE.org MITRE

published 2021-11-09modified 2026-06-17

references (6)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan