CVE-2021-41841

highpriority · track · 33EPSS 0.003 · 23 %ileDEEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.30% (23rd) EPSS

CVSS 7.2 · high

Is it mine?

43 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · nvd · siemens_psirt

EPSS · scored 2026-10-27

An issue was discovered in AhciBusDxe in the kernel 5.0 through 5.5 in Insyde InsydeH2O. There is an SMM callout that allows an attacker to access the System Management Mode and execute arbitrary code. This occurs because of Inclusion of Functionality from an Untrusted Control Sphere.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedRUGGEDCOM APE1808 - BIOSsiemens_psirt
Update to V1.0.202N or later version
https://support.industry.siemens.com/cs/ww/en/view/109814796/
FixedSIMATIC Field PG M5siemens_psirt
Update to V22.01.10 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
FixedSIMATIC Field PG M6siemens_psirt
Update to V26.01.13 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
FixedSIMATIC IPC127Esiemens_psirt
Update to V27.01.09 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
FixedSIMATIC IPC227Gsiemens_psirt
Update to V28.01.04 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
FixedSIMATIC IPC277Gsiemens_psirt
Update to V28.01.04 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
FixedSIMATIC IPC327Gsiemens_psirt
Update to V28.01.04 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
FixedSIMATIC IPC377Gsiemens_psirt
Update to V28.01.04 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
FixedSIMATIC IPC427Esiemens_psirt
Update to V21.01.17 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
FixedSIMATIC IPC477Esiemens_psirt
Update to V21.01.17 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
FixedSIMATIC IPC477E Prosiemens_psirt
Update to V21.01.17 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
FixedSIMATIC IPC627Esiemens_psirt
Update to V25.02.12 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
FixedSIMATIC IPC647Esiemens_psirt
Update to V25.02.12 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
FixedSIMATIC IPC677Esiemens_psirt
Update to V25.02.12 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
FixedSIMATIC IPC847Esiemens_psirt
Update to V25.02.12 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
FixedSIMATIC ITP1000siemens_psirt
Update to V23.01.10 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
FixedSIMATIC IPC277G PROsiemens_psirt
Update to V28.01.04 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
FixedSIPLUS IPC427Esiemens_psirt
Update to V21.01.17 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
MitigationRUGGEDCOM APE1808 - BIOSsiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code
MitigationSIMATIC Field PG M5siemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code
MitigationSIMATIC Field PG M6siemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code
MitigationSIMATIC IPC127Esiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code
MitigationSIMATIC IPC227Gsiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code
MitigationSIMATIC IPC277Gsiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code
MitigationSIMATIC IPC327Gsiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code
MitigationSIMATIC IPC377Gsiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code
MitigationSIMATIC IPC427Esiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code
MitigationSIMATIC IPC477Esiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code
MitigationSIMATIC IPC477E Prosiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code
MitigationSIMATIC IPC627Esiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code
MitigationSIMATIC IPC647Esiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code
MitigationSIMATIC IPC677Esiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code
MitigationSIMATIC IPC847Esiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code
MitigationSIMATIC ITP1000siemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code
MitigationSIMATIC IPC277G PROsiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code
MitigationSIPLUS IPC427Esiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code

cvss

Technical severity, 0–10. One row per scoring source.

8.2

010

base score 0–10 · higher = more severe · hover a vector to decode

v2.07.2highAV:L/AC:L/Au:N/C:C/I:C/A:Cprimary · NVD / NIST USexploitability 3.9 · impact 10

v3.18.2highCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 1.5 · impact 6

v3.18.2highCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:Hsecondary · Siemens ProductCERT DE

v3.17.5highCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-829USprimaryCWE-829US

affected products (43)

Products and version ranges known to be affected.

n/a n/a≤ n/aenisa_euvdEU
insyde insydeh2o5.0 → 5.08.29nvdUScpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*
insyde insydeh2o5.1 → 5.16.29nvdUScpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*
insyde insydeh2o5.2 → 5.26.29nvdUScpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*
insyde insydeh2o5.3 → 5.35.29nvdUScpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*
insyde insydeh2o5.4 → 5.43.29nvdUScpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*
insyde insydeh2o5.5 → 5.51.29nvdUScpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*
Siemens RUGGEDCOM APE1808 - BIOS≤ vers:intdot/<1.0.202Nsiemens_psirtDE
Siemens RUGGEDCOM APE1808 - BIOS < V1.0.202N≤ vers:intdot/<1.0.202Nsiemens_psirtDE
Siemens SIMATIC Field PG M5≤ vers:intdot/<22.01.10siemens_psirtDE
Siemens SIMATIC Field PG M5 < V22.01.10≤ vers:intdot/<22.01.10siemens_psirtDE
Siemens SIMATIC Field PG M6≤ vers:intdot/<26.01.13siemens_psirtDE
Siemens SIMATIC Field PG M6 < V26.01.13≤ vers:intdot/<26.01.13siemens_psirtDE
Siemens SIMATIC IPC127E≤ vers:intdot/<27.01.09siemens_psirtDE
Siemens SIMATIC IPC127E < V27.01.09≤ vers:intdot/<27.01.09siemens_psirtDE
Siemens SIMATIC IPC227G≤ vers:intdot/<28.01.04siemens_psirtDE
Siemens SIMATIC IPC227G < V28.01.04≤ vers:intdot/<28.01.04siemens_psirtDE
Siemens SIMATIC IPC277G≤ vers:intdot/<28.01.04siemens_psirtDE
Siemens SIMATIC IPC277G < V28.01.04≤ vers:intdot/<28.01.04siemens_psirtDE
Siemens SIMATIC IPC327G≤ vers:intdot/<28.01.04siemens_psirtDE

showing 20 of 43

advisories (1)

Vendor and ecosystem advisories describing this.

SSA-306654SSA-306654: Insyde BIOS Vulnerabilities in Siemens Industrial Products2022-02-22csaf · siemens_psirtDE
Insyde has published information on vulnerabilities in Insyde BIOS in February 2022. This advisory lists the Siemens Industrial products affected by these vulnerabilities. Siemens has released new versions for the affected products and recommends to update to the latest versions.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd nvd siemens_psirt NVD CVE.org MITRE

published 2022-02-03modified 2026-08-11

related (460)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-0770US	—OT critical	62.6% (99th)	KEV	2026-01-23
Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary…
CVE-2025-32463US	high7.8OT critical	55.5% (99th)	KEV	2025-06-30
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.
CVE-2018-17246US	critical9.8	84.3% (100th)	Exploit	2018-12-20
Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that…
CVE-2023-48022US	critical9.8OT high	83.9% (100th)	Exploit	2023-11-28
Anyscale Ray 2.6.3 and 2.8.0 allows a remote attacker to execute arbitrary code via the job submission API. NOTE: the vendor's position is that this report is irrelevant because Ra…
CVE-1999-0661US	high10.0	54.2% (99th)	Exploit	1999-01-01
A system is running a version of software that was replaced with a Trojan Horse at one of its distribution points, such as (1) TCP Wrappers 7.6, (2) util-linux 2.9g, (3) wuarchive…

+455 more

references (18)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan