CVE-2021-42021

mediumpriority · track · 31EPSS 0.017 · 78 %ileDEEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

1.74% (78th) EPSS

CVSS 5 · medium

Is it mine?

27 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · cisa_csaf_ot · nvd

EPSS · scored 2026-10-26

A vulnerability has been identified in Siveillance Video DLNA Server (2019 R1), Siveillance Video DLNA Server (2019 R2), Siveillance Video DLNA Server (2019 R3), Siveillance Video DLNA Server (2020 R1), Siveillance Video DLNA Server (2020 R2), Siveillance Video DLNA Server (2020 R3), Siveillance Video DLNA Server (2021 R1). The affected application contains a path traversal vulnerability that could allow to read arbitrary files on the server that are outside the application’s web document directory. An unauthenticated remote attacker could exploit this issue to access sensitive information for subsequent attacks.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedSiveillance Video DLNA Serversiemens_psirt
Apply the hotfix using the latest available installer for the DLNA Server
https://support.industry.siemens.com/cs/ww/en/view/109766085/
FixedSiveillance Video DLNA Servercisa_csaf_ot
Apply the hotfix using the latest available installer for the DLNA Server
https://support.industry.siemens.com/cs/ww/en/view/109766085/
MitigationSiveillance Video DLNA Serversiemens_psirt
Disable the DLNA Server, if not in use. Note: By default, the DLNA server is not installed with the other components of Siveillance Video
MitigationSiveillance Video DLNA Servercisa_csaf_ot
Disable the DLNA Server, if not in use. Note: By default, the DLNA server is not installed with the other components of Siveillance Video

cvss

Technical severity, 0–10. One row per scoring source.

8.6

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5–8.6

v2.05mediumAV:N/AC:L/Au:N/C:P/I:N/A:Nprimary · NVD / NIST USexploitability 10 · impact 2.9

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nprimary · NVD / NIST USexploitability 3.9 · impact 3.6

v3.18.6highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N/E:P/RL:O/RC:Csecondary · CISA US

v3.18.6highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N/E:P/RL:O/RC:Csecondary · Siemens ProductCERT DE

v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-22USprimaryCWE-26USCWE-26USCWE-26US

affected products (27)

Products and version ranges known to be affected.

Siveillance Video DLNA Serverall versionscisa_csaf_otUS
Siemens Siveillance Video DLNA Server≤ 2019_R2cisa_csaf_otUS
Siemens Siveillance Video DLNA Server≤ 2019_R3cisa_csaf_otUS
Siemens Siveillance Video DLNA Server≤ 2020_R1cisa_csaf_otUS
Siemens Siveillance Video DLNA Server≤ 2020_R2cisa_csaf_otUS
Siemens Siveillance Video DLNA Server≤ 2020_R3cisa_csaf_otUS
Siemens Siveillance Video DLNA Server≤ 2019_R1cisa_csaf_otUS
Siemens Siveillance Video DLNA Server≤ 2021_R1cisa_csaf_otUS
Siemens Siveillance Video DLNA Server≤ 2019 R1enisa_euvdEU
Siemens Siveillance Video DLNA Server≤ 2020 R2enisa_euvdEU
Siemens Siveillance Video DLNA Server≤ 2020 R1enisa_euvdEU
Siemens Siveillance Video DLNA Server≤ 2019 R3enisa_euvdEU
Siemens Siveillance Video DLNA Server≤ 2021 R1enisa_euvdEU
Siemens Siveillance Video DLNA Server≤ 2020 R3enisa_euvdEU
Siemens Siveillance Video DLNA Server≤ 2019 R2enisa_euvdEU
siemens siveillance video management software 2019 r1all versionsnvdUScpe:2.3:a:siemens:siveillance_video_management_software_2019_r1:*:*:*:*:*:*:*:*
siemens siveillance video management software 2019 r2all versionsnvdUScpe:2.3:a:siemens:siveillance_video_management_software_2019_r2:*:*:*:*:*:*:*:*
siemens siveillance video management software 2019 r3all versionsnvdUScpe:2.3:a:siemens:siveillance_video_management_software_2019_r3:*:*:*:*:*:*:*:*
siemens siveillance video management software 2020 r1all versionsnvdUScpe:2.3:a:siemens:siveillance_video_management_software_2020_r1:*:*:*:*:*:*:*:*
siemens siveillance video management software 2020 r2all versionsnvdUScpe:2.3:a:siemens:siveillance_video_management_software_2020_r2:*:*:*:*:*:*:*:*

showing 20 of 27

advisories (2)

Vendor and ecosystem advisories describing this.

SSA-755517SSA-755517: Path Traversal Vulnerability in Siveillance Video DLNA Server2021-11-09csaf · siemens_psirtDE
Siemens has released hotfixes for Siveillance Video DLNA Server, which fix a path traversal vulnerability that could allow an authenticated remote attacker to access sensitive information on the DLNA server. Siemens has released updates for the DLNA server and recommends to apply the update on all installations where DLNA server used.
ICSA-21-315-13Siemens Siveillance Video DLNA Server2021-11-09icsa · cisa_csaf_otUS
Siemens has released hotfixes for Siveillance Video DLNA Server, which fix a path traversal vulnerability that could allow an authenticated remote attacker to access sensitive information on the DLNA server. Siemens has released updates for the DLNA server and recommends to apply the update on all installations where DLNA server used.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cisa_csaf_ot nvd siemens_psirt NVD CVE.org MITRE

published 2021-11-09modified 2026-06-17

related (12,513)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-104286US	—OT critical	4.57% (92nd)	KEV	2026-10-01
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail…
CVE-2026-93616US	—OT critical	91.6% (100th)	KEV	2026-09-22
A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.
CVE-2026-85706US	—OT critical	97.4% (100th)	KEV	2026-09-12
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2…
CVE-2026-66384US	—OT critical	0.66% (52nd)	KEV	2026-08-12
An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.
CVE-2026-59310US	—OT critical	2.56% (85th)	KEV	2026-07-30
VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.

+12508 more

references (6)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan