CVE-2021-44228

highpriority · act · 90OT risk · criticalKEV · exploitedEPSS 1.000 · 100 %ileexploit · weaponizedDEEUFRRUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 472 exploits · weaponized

Likely / severe?

100.0% (100th) EPSS

CVSS 9.3 · high

Is it mine?

758 products

Check your exposure

Who says so?

11 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

added 2021-12-10remediate by 2021-12-24

required action For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.

EPSS · scored 2026-10-21

Apache Log4j2 Remote Code Execution Vulnerability

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedAppManagersick_psirt
Fixed on vendorside
FixedAppStudiosick_psirt
Fixed on vendorside
FixedFieldEchosick_psirt
Fixed on vendorside
FixedFieldEcho Dashboardsick_psirt
Fixed on vendorside
FixedFunction Block Factorysick_psirt
Fixed on vendorside
FixedSensformer / Sensgear Platformsiemens_psirt
Vulnerabilities fixed on central cloud service between 2021-12-10 (CVE-2021-44228) and 2021-12-21 (CVE-2021-45105); no user actions necessary
FixedAdvantage Navigator Energy & Sustainabilitysiemens_psirt
Vulnerability CVE-2021-44228 fixed on central cloud service starting 2021-12-13; no user actions necessary
FixedAdvantage Navigator Software Proxy V6siemens_psirt
Update to V6.3 or later version
FixedBuilding Operator Discovery Distribution for the Connect X200 Gatewaysiemens_psirt
Update to V3.0.30 or later version
https://support.industry.siemens.com/cs/ww/en/view/109805593/
FixedBuilding Operator Discovery Distribution for the Connect X300 Gatewaysiemens_psirt
Update to V3.0.29 or later version
https://support.industry.siemens.com/cs/ww/en/view/109805593/
FixedBuilding Twin - 360° Viewersiemens_psirt
Vulnerability CVE-2021-44228 fixed on central cloud service; no user actions necessary
FixedCOMOSsiemens_psirt
Update to V10.4.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812011/
FixedCapital V2019.1siemens_psirt
Update to V2019.1 SP2204 or later version
https://support.sw.siemens.com/en- US/product/861057055/downloads
FixedCapital V2020.1siemens_psirt
Update to V2020.1 SP2202 or later version
https://support.sw.siemens.com/en- US/product/861057055/downloads
FixedCapital V2021.1siemens_psirt
Update to V2021.1 SP2202 or later version
https://support.sw.siemens.com/en- US/product/861057055/downloads
FixedCerberus DMS V5.0siemens_psirt
Remove the JndiLookup class from the classpath. Detailed instructions are available at https://support.industry.siemens.com/cs/ww/en/view/109805562/
FixedCerberus DMS V5.1siemens_psirt
Remove the JndiLookup class from the classpath. Detailed instructions are available at https://support.industry.siemens.com/cs/ww/en/view/109805562/
FixedDesigo CC V3.0siemens_psirt
Remove the JndiLookup class from the classpath. Detailed instructions are available at https://support.industry.siemens.com/cs/ww/en/view/109805562/
FixedDesigo CC V4.0siemens_psirt
Remove the JndiLookup class from the classpath. Detailed instructions are available at https://support.industry.siemens.com/cs/ww/en/view/109805562/
FixedDesigo CC V4.1siemens_psirt
Remove the JndiLookup class from the classpath. Detailed instructions are available at https://support.industry.siemens.com/cs/ww/en/view/109805562/
FixedDesigo CC V4.2siemens_psirt
Remove the JndiLookup class from the classpath. Detailed instructions are available at https://support.industry.siemens.com/cs/ww/en/view/109805562/
FixedDesigo CC V5.0siemens_psirt
Remove the JndiLookup class from the classpath. Detailed instructions are available at https://support.industry.siemens.com/cs/ww/en/view/109805562/
FixedDesigo CC V5.1siemens_psirt
Update to V5.1 QU1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109807893/
FixedE-Car OC Cloud Applicationsiemens_psirt
Vulnerability CVE-2021-44228 fixed on central cloud service starting 2021-12-13; no user actions necessary
FixedEnergy Engagesiemens_psirt
Find detailed remediation and mitigation information on the EnergyIP docs portal at: https://docs.emeter.com/display/public/WELCOME/Energy IP+Security+Advisory+for+Log4Shell+Vulnerability
FixedEnergyIPsiemens_psirt
Find detailed remediation and mitigation information on the EnergyIP docs portal at: https://docs.emeter.com/display/public/WELCOME/Energy IP+Security+Advisory+for+Log4Shell+Vulnerability
FixedEnergyIP Prepaysiemens_psirt
Update to V3.8.0.12 or later version
FixedEnlighted Amazesiemens_psirt
Vulnerabilities fixed on central cloud services starting 2021-12-10; no user actions necessary
FixedEnlighted Wheresiemens_psirt
Vulnerabilities fixed on central cloud services starting 2021-12-11; no user actions necessary
FixedGMA-Managersiemens_psirt
Update to V8.6.2.472 or later version
https://support.industry.siemens.com/cs/ww/en/view/109805665/
FixedGeolus Shape Search V10siemens_psirt
Remove the JndiLookup class from the classpath.
FixedGeolus Shape Search V11siemens_psirt
Remove the JndiLookup class from the classpath.
FixedHEEDS Connectsiemens_psirt
HEEDS Connect team will contact all impacted customers to deploy a new log4j version. This action will secure your installation against Log4Shell vulnerability. For further information see: https://support.sw.siemens.com/en-US/knowledge-base/PL8601661
FixedHES UDISsiemens_psirt
Specific fix versions based on V6.0.2 and V6.0.3 were released and deployed for all affected projects
FixedIndustrial Edge Hubsiemens_psirt
Vulnerabilities fixed on central cloud service starting 2021-12-13; no user actions necessary
FixedIndustrial Edge Management App (IEM-App)siemens_psirt
Update to V1.4.11 or later version
https://iehub.eu1.edge.siemens.cloud/
FixedIndustrial Edge Management OS (IEM-OS)siemens_psirt
Update to V1.4.0-42 or later version
https://iehub.eu1.edge.siemens.cloud/
FixedMendix Applicationssiemens_psirt
Although the Mendix runtime itself is not vulnerable to this exploit, we nevertheless recommend to upgrade log4j-core to the latest available version if log4j-core is part of your project. This advice is regardless of the JRE/JDK version the app runs on.
https://status.mendix.com/incidents/8j5043my610c
FixedMindSphere App Management Cockpits (Developer& Operator)siemens_psirt
Vulnerabilities fixed with update on 2021-12-16; no user actions necessary
FixedMindSphere Asset Managersiemens_psirt
Vulnerabilities fixed with update on 2021-12-16; no user actions necessary
FixedMindSphere IAM (User Management/ Settings)siemens_psirt
Vulnerabilities fixed with update on 2021-12-16; no user actions necessary
FixedMindSphere Integrated Data Lakesiemens_psirt
Vulnerabilities fixed with update on 2021-12-16; no user actions necessary
FixedMindSphere Notification Servicesiemens_psirt
Vulnerabilities fixed with update on 2021-12-16; no user actions necessary
FixedMindSphere Predictive Learningsiemens_psirt
Vulnerabilities fixed with update on 2021-12-23; no user actions necessary
FixedMindSphere Usage Transparency Servicesiemens_psirt
Vulnerabilities fixed with update on 2021-12-16; no user actions necessary
FixedMindSphere Visual Explorersiemens_psirt
Vulnerabilities fixed with update on 2021-12-21; no user actions necessary
FixedMindsphere Cloud Foundrysiemens_psirt
Although the Cloud Foundry environment itself is not vulnerable to this exploit, we nevertheless recommend to upgrade log4j-core to the latest available version if log4j-core is part of your project. https://support.sw.siemens.com/en-US/product/268530510/knowledge- base/PL8600797
FixedMindsphere Cloud Platformsiemens_psirt
Vulnerabilities fixed on central cloud service starting 2021-12-11; no user actions necessary
FixedNX 1953 Seriessiemens_psirt
Update to V1973.4340 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600959
FixedNX 1980 Seriessiemens_psirt
Update to V2000.3400 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600959
FixedNX 2007 Seriessiemens_psirt
Update to V2008 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600959
FixedNXpower Monitorsiemens_psirt
Vulnerabilities fixed on central cloud service starting 2021-12-19; no user actions necessary
FixedOpcenter EX CP Process Automation Controlsiemens_psirt
Update to V18.1 or later version to fix CVE-2021-44228
FixedOpcenter Execution Core Process Automation Controlsiemens_psirt
Update to V18.1 or later version to fix CVE-2021-44228
FixedOpcenter Intelligencesiemens_psirt
Update to V3.5 or later version
https://support.sw.siemens.com/
FixedOperation Schedulersiemens_psirt
Update the UAA component to V75.8.3
https://support.industry.siemens.com/cs/ww/en/view/109805673/
FixedSENTRON powermanager V4siemens_psirt
Remove the JndiLookup class from the classpath. Detailed instructions are available at https://support.industry.siemens.com/cs/ww/en/view/109805602/
FixedSIGUARD DSAsiemens_psirt
Update to V4.4.1 or later version
FixedSIMATIC IPC1047siemens_psirt
Update the driver for the SmartRAID controller to V2.6.6 or later version, available at https://storage.microsemi.com/en- us/support/raid/sas_raid/asr-3151-4i/
FixedSIMATIC IPC1047Esiemens_psirt
Update the driver for the SmartRAID controller to V2.6.6 or later version, available at https://storage.microsemi.com/en- us/support/raid/sas_raid/asr-3151-4i/
FixedSIMATIC IPC647Dsiemens_psirt
Follow the remediation steps documented at https://ask.adaptec.com/app/answers/detail/a_id/17527/
FixedSIMATIC IPC647Esiemens_psirt
Update the driver for the SmartRAID controller to V2.6.6 or later version, available at https://storage.microsemi.com/en- us/support/raid/sas_raid/asr-3151-4i/
FixedSIMATIC IPC847Dsiemens_psirt
Follow the remediation steps documented at https://ask.adaptec.com/app/answers/detail/a_id/17527/
FixedSIMATIC IPC847Esiemens_psirt
Update the driver for the SmartRAID controller to V2.6.6 or later version, available at https://storage.microsemi.com/en- us/support/raid/sas_raid/asr-3151-4i/
FixedSiPass integrated V2.80siemens_psirt
Apply the patch
https://support.industry.siemens.com/cs/ww/en/view/109805711/
FixedSiPass integrated V2.85siemens_psirt
Update to V2.85.7.5 or later version
https://support.industry.siemens.com/cs/ww/en/view/109801507/
FixedSimcenter 3Dsiemens_psirt
Update to 2022.1-2008 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8603477
FixedSimcenter Amesimsiemens_psirt
Update Teamcenter to any fix version available for the different version lines of Teamcenter, see https://support.sw.siemens.com/en- US/knowledge-base/PL8600700
https://support.sw.siemens.com/en-US/knowledge- base/PL8601572
FixedSimcenter System Architectsiemens_psirt
Update Teamcenter to any fix version available for the different version lines of Teamcenter, see https://support.sw.siemens.com/en- US/knowledge-base/PL8600700
https://support.sw.siemens.com/en-US/knowledge- base/PL8601662
FixedSimcenter System Simulation Client for Gitsiemens_psirt
Update to V2021.2.2 or later version
https://support.sw.siemens.com
FixedSimcenter Testlabsiemens_psirt
Follow the remediation steps documented at: https://support.sw.siemens.com/en-US/knowledge-base/PL8602466
FixedSimcenter Testlab Data Managementsiemens_psirt
Simcenter Testlab Data Management team will contact all impacted customer to deploy the mitigation measures. This action will secure your installation against Log4Shell vulnerability. For further information see: https://support.sw.siemens.com/en-US/knowledge- base/PL8601418
FixedSiveillance Commandsiemens_psirt
Vulnerabilities fixed for Command installations on a project basis; no user actions necessary
FixedSiveillance Control Pro V2.1siemens_psirt
A hotfix is available; please contact customer support to receive the hotfix
FixedSiveillance Control Pro V2.2siemens_psirt
Update to V2.2.7 or later version; please contact customer support to receive the latest version
FixedSiveillance Control Pro V2.3siemens_psirt
Update to V2.3.2 or later version; please contact customer support to receive the latest version
FixedSiveillance Identity V1.5siemens_psirt
Update to V1.5 SP4 and apply the patch
https://support.industry.siemens.com/cs/ww/en/view/109805657/
FixedSiveillance Identity V1.6siemens_psirt
Update to V1.6 SP1 and apply the patch
https://support.industry.siemens.com/cs/ww/en/view/109805657/
FixedSiveillance Vantagesiemens_psirt
Vulnerabilities fixed for Vantage installations on a project basis; no user actions necessary
FixedSolid Edge CAM Prosiemens_psirt
Update to V2008 or later version
https://support.sw.siemens.com/
FixedSolid Edge Wiring and Harness Designsiemens_psirt
Update to V2022 SP2202 or later version
https://support.sw.siemens.com/en- US/product/246738425/downloads
FixedSpectrum Power 4siemens_psirt
Update to V4.70 SP9 and apply Security Patch 1. Please contact your local Siemens representative.
FixedSpectrum Power 7siemens_psirt
Update to V21Q4 and apply the patch. Please contact your local Siemens representative.
FixedTeamcenter Active Workspace V4.3siemens_psirt
Update to V4.3.13 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700
FixedTeamcenter Active Workspace V5.0siemens_psirt
Update to V5.0.11 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700
FixedTeamcenter Active Workspace V5.1siemens_psirt
Update to V5.1.8 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700
FixedTeamcenter Active Workspace V5.2siemens_psirt
Update to V5.2.6 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700
FixedTeamcenter Deployment Center V4.0siemens_psirt
Update to V4.0.3 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700
FixedTeamcenter Deployment Center V4.1siemens_psirt
Update to V4.1.1.1 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700
FixedTeamcenter Deployment Center V4.2siemens_psirt
Update to V4.2.0.2 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700
FixedTeamcenter EDA V5.1siemens_psirt
Update to V5.1.5 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700
FixedTeamcenter EDA V5.2siemens_psirt
Update to V5.2.3 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700
FixedTeamcenter Integration Framework V13.0siemens_psirt
Update to V13.0.0.2 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700
FixedTeamcenter Integration Framework V13.1siemens_psirt
Update to V13.1.0.1 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700
FixedTeamcenter Integration Framework V13.2siemens_psirt
Update to V13.2.0.1 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700
FixedTeamcenter Integration Framework V3.3siemens_psirt
Update to V3.3.0.7 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700
FixedTeamcenter Integration Framework V4.0siemens_psirt
Update to V4.0.0.2 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700
FixedTeamcenter Integration for CATIAsiemens_psirt
Update to V13.0.1.2 or later version
https://support.sw.siemens.com/knowledge- base/PL8602463
FixedTeamcenter MBSE Gateway V4.1siemens_psirt
Update to V4.1.2 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700
FixedTeamcenter MBSE Gateway V4.2siemens_psirt
Update to V4.2.3 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700
FixedTeamcenter MBSE Gateway V4.3siemens_psirt
Update to V4.3.3 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700
FixedTeamcenter MBSE Gateway V5.0siemens_psirt
Update to V5.0.6 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700
FixedTeamcenter MBSE Gateway V5.1siemens_psirt
Update to V5.1.5 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700
FixedTeamcenter MBSE Gateway V5.2siemens_psirt
Update to V5.2.4 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700
FixedTeamcenter Microservices Framework V5.1siemens_psirt
Update to V5.1.8 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700
FixedTeamcenter Microservices Framework V5.2siemens_psirt
Update to V5.2.6 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700
FixedTeamcenter Reporting and Analytics V11siemens_psirt
Remove the JndiLookup class from the classpath.
FixedTeamcenter Reporting and Analytics V12.2siemens_psirt
Update to V12.2.8 or later version
https://support.sw.siemens.com/enUS/knowledge- base/PL8600700
FixedTeamcenter Reporting and Analytics V12.3siemens_psirt
Update to V12.3.11 or later version
https://support.sw.siemens.com/enUS/knowledge- base/PL8600700
FixedTeamcenter Reporting and Analytics V12.4siemens_psirt
Update to V12.4.1 or later version
https://support.sw.siemens.com/enUS/knowledge- base/PL8600700
FixedTeamcenter Reporting and Analytics V13siemens_psirt
Update to V13.2.1.1 or V13.3.0.0 or later version
https://support.sw.siemens.com/enUS/knowledge- base/PL8600700
FixedTeamcenter Technical Publishingsiemens_psirt
Update to V13.0.1 or later version
https://support.sw.siemens.com/knowledge- base/PL8612040
FixedTeamcenter V12.1siemens_psirt
Update to V12.1.0.14 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700
FixedTeamcenter V12.2siemens_psirt
Update to V12.2.0.18 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700
FixedTeamcenter V12.3siemens_psirt
Update to V12.3.0.15 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700
FixedTeamcenter V12.4siemens_psirt
Update to V12.4.0.12 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700
FixedTeamcenter V13.0siemens_psirt
Update to V13.0.0.9 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700
FixedTeamcenter V13.1siemens_psirt
Update to V13.1.0.8 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700
FixedTeamcenter V13.2siemens_psirt
Update to V13.2.0.6 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700
FixedTeamcenter V13.3siemens_psirt
Update to V13.3.0.1 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700
FixedTecnomatix Intositesiemens_psirt
Vulnerabilities fixed on central cloud service; no user actions necessary
FixedTecnomatix Plant Simulationsiemens_psirt
Download and install the updated TCCS setup from the Siemens Support Center; for details see https://support.sw.siemens.com/knowledge- base/PL8615527
FixedTecnomatix Process Designersiemens_psirt
Apply the hotfix, available for versions V14.1, V15.0, V15.1, V15.1.2, V16.0, V16.0.1, V16.0.2, V16.1, V16.1.1, V16.1.2
https://support.sw.siemens.com/en-US/knowledge- base/PL8602057
FixedTecnomatix Process Simulatesiemens_psirt
Apply the hotfix, available for versions V14.1, V15.0, V15.1, V15.1.2, V16.0, V16.0.1, V16.0.2, V16.1, V16.1.1, V16.1.2
https://support.sw.siemens.com/en-US/knowledge- base/PL8602057
FixedTecnomatix Process Simulate VCLitesiemens_psirt
Apply the hotfix, available for versions V14.1, V15.0, V15.1, V15.1.2, V16.0, V16.0.1, V16.0.2, V16.1, V16.1.1, V16.1.2
https://support.sw.siemens.com/en-US/knowledge- base/PL8602057
FixedTecnomatix RobotExpertsiemens_psirt
Apply the hotfix, available for versions V14.1, V15.0, V15.1, V15.1.2, V16.0, V16.0.1, V16.0.2, V16.1, V16.1.1, V16.1.2
https://support.sw.siemens.com/en-US/knowledge- base/PL8602057
FixedTecnomatix eBOP Manager Serversiemens_psirt
Apply the hotfix
https://support.sw.siemens.com/en-US/knowledge- base/PL8602057
FixedValor Parts Library - VPL Directsiemens_psirt
Vulnerabilities fixed on remote VPL server; no user actions necessary
FixedValor Parts Library - VPL Server or Servicesiemens_psirt
Remove the JndiLookup class from the classpath.
FixedVeSys V2020.1siemens_psirt
Update to V2020.1 SP2202 or later version
https://support.sw.siemens.com/en- US/product/852852123/downloads
FixedVeSys V2021.1siemens_psirt
Update to V2021.1 SP2202 or later version
https://support.sw.siemens.com/en- US/product/852852123/downloads
FixedXpedition Enterprise (XCR) VX.2.10siemens_psirt
Update to VX.2.10 Update 4 or later version
https://support.sw.siemens.com/en-US/product/1644094854/download/2022 01034
FixedXpedition Enterprise VX.2.10siemens_psirt
Update to VX.2.10 Update 4 or later version
https://support.sw.siemens.com/en-US/product/852852130/download/20220 1033
FixedXpedition Enterprise VX.2.6siemens_psirt
Apply the hotfix
https://support.sw.siemens.com/en-US/product/1644094854/knowledge- base/MG618343
FixedXpedition Enterprise VX.2.7siemens_psirt
Update to VX.2.7 Update 19 or later version
https://support.sw.siemens.com/en-US/product/852852130/download/20220 1039
FixedXpedition Enterprise VX.2.8siemens_psirt
Update to VX.2.8 Update 13 or later version
https://support.sw.siemens.com/en-US/product/852852130/download/20220 1037
FixedXpedition IC Packaging (XCR) VX.2.10siemens_psirt
Update to VX.2.10 Update 4 or later version
https://support.sw.siemens.com/en-US/product/1644094857/download/2022 01036
FixedXpedition IC Packaging VX.2.10siemens_psirt
Update to VX.2.10 Update 4 or later version
https://support.sw.siemens.com/en-US/product/1091814625/download/2022 01035
FixedXpedition IC Packaging VX.2.6siemens_psirt
Apply the hotfix
https://support.sw.siemens.com/en-US/product/1644094854/knowledge- base/MG618343
FixedXpedition IC Packaging VX.2.7siemens_psirt
Update to VX.2.7 Update 19 or later version
https://support.sw.siemens.com/en-US/product/1091814625/download/2022 01040
FixedXpedition IC Packaging VX.2.8siemens_psirt
Update to VX.2.8 Update 13 or later version
https://support.sw.siemens.com/en-US/product/1091814625/download/2022 01038
FixedcRSPsiemens_psirt
Update to V13.17.2 was deployed on all cRSP services on 2021-12-21; no user actions necessary
FixedcRSP Operator Client Startersiemens_psirt
Update to V1.7.18 or later version, as provided via cRSP V13.17.2 or later version
FixedjROS for Spectrum Power 4siemens_psirt
Update to V4.70 SP9 Security Patch 1 or later version. Please contact your local Siemens representative.
FixedjROS for Spectrum Power 7siemens_psirt
Apply the patch. Please contact your local Siemens representative.
FixedFirmware 4.2<4.8.1.4 installed on WAGO Smart Scriptwago_psirt
UPDATE A2/2:Install Version 4.8.1.5 or later of WAGO Smart Script, which is available on our Website.Customers using Version 4.6 or higher can already use the integrated 'Check for update' function of WAGO Smart Script to update to Version 4.8.1.5.END UPDATE A2/2
FixedCisco Unified Communications Manager / Cisco Unity Connectioncisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco Unified Communications Manager IM and Presence Servicecisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedPowerManagecisa_csaf_ot
Upgrade PowerManage to Version 4.10
https://www.johnsoncontrols.com/cyber-solutions/security-advisories
MitigationTraceAlertServerPLUSsiemens_psirt
Check file system permissions
MitigationAdvantage Navigator Energy & Sustainabilitysiemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationAdvantage Navigator Software Proxy V6siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationBuilding Operator Discovery Distribution for the Connect X200 Gatewaysiemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationBuilding Operator Discovery Distribution for the Connect X300 Gatewaysiemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationBuilding Twin - 360° Viewersiemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationCOMOSsiemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationCapital V2019.1siemens_psirt
Find detailed mitigation steps at: https://support.sw.siemens.com/en- US/knowledge-base/MG618363
MitigationCapital V2020.1siemens_psirt
Find detailed mitigation steps at: https://support.sw.siemens.com/en- US/knowledge-base/MG618363
MitigationCapital V2021.1siemens_psirt
Find detailed mitigation steps at: https://support.sw.siemens.com/en- US/knowledge-base/MG618363
MitigationCerberus DMS V5.0siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationCerberus DMS V5.1siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationDesigo CC V3.0siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationDesigo CC V4.0siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationDesigo CC V4.1siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationDesigo CC V4.2siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationDesigo CC V5.0siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationDesigo CC V5.1siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationE-Car OC Cloud Applicationsiemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationEnergy Engagesiemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationEnergyIPsiemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationEnergyIP Prepaysiemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationEnlighted Amazesiemens_psirt
For Comfy and Enlighted, see also chapter Additional Information below
MitigationEnlighted Wheresiemens_psirt
For Comfy and Enlighted, see also chapter Additional Information below
MitigationGMA-Managersiemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationGeolus Shape Search V10siemens_psirt
Find detailed remediation and mitigation information at: https://support.sw.siemens.com/en-US/knowledge-base/PL8601468
MitigationGeolus Shape Search V11siemens_psirt
Find detailed remediation and mitigation information at: https://support.sw.siemens.com/en-US/knowledge-base/PL8601468
MitigationHEEDS Connectsiemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationHES UDISsiemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationIndustrial Edge Hubsiemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationIndustrial Edge Management App (IEM-App)siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationIndustrial Edge Management OS (IEM-OS)siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationMendix Applicationssiemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationMindSphere App Management Cockpits (Developer& Operator)siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationMindSphere Asset Managersiemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationMindSphere IAM (User Management/ Settings)siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationMindSphere Integrated Data Lakesiemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationMindSphere Notification Servicesiemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationMindSphere Predictive Learningsiemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationMindSphere Usage Transparency Servicesiemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationMindSphere Visual Explorersiemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationMindsphere Cloud Foundrysiemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationMindsphere Cloud Platformsiemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationNX 1953 Seriessiemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationNX 1980 Seriessiemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationNX 2007 Seriessiemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationNXpower Monitorsiemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationOpcenter EX CP Process Automation Controlsiemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationOpcenter Execution Core Process Automation Controlsiemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationOpcenter Intelligencesiemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationOperation Schedulersiemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationSENTRON powermanager V4siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationSIGUARD DSAsiemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationSIMATIC IPC1047siemens_psirt
Disable ports 8080/tcp and 8443/tcp in the firewall configuration of the IPC
MitigationSIMATIC IPC1047Esiemens_psirt
Disable ports 8080/tcp and 8443/tcp in the firewall configuration of the IPC
MitigationSIMATIC IPC647Dsiemens_psirt
Disable ports 8080/tcp and 8443/tcp in the firewall configuration of the IPC
MitigationSIMATIC IPC647Esiemens_psirt
Disable ports 8080/tcp and 8443/tcp in the firewall configuration of the IPC
MitigationSIMATIC IPC847Dsiemens_psirt
Disable ports 8080/tcp and 8443/tcp in the firewall configuration of the IPC
MitigationSIMATIC IPC847Esiemens_psirt
Disable ports 8080/tcp and 8443/tcp in the firewall configuration of the IPC
MitigationSiPass integrated V2.80siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationSiPass integrated V2.85siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationSimcenter 3Dsiemens_psirt
Find detailed remediation and mitigation information at: https://support.sw.siemens.com/en-US/knowledge-base/PL8601203
MitigationSimcenter Amesimsiemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationSimcenter System Architectsiemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationSimcenter System Simulation Client for Gitsiemens_psirt
Find detailed mitigation steps for both server and client installations at: https://support.sw.siemens.com/en-US/knowledge- base/PL8602538
MitigationSimcenter Testlabsiemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationSimcenter Testlab Data Managementsiemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationSiveillance Commandsiemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationSiveillance Control Pro V2.1siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationSiveillance Control Pro V2.2siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationSiveillance Control Pro V2.3siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationSiveillance Identity V1.5siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationSiveillance Identity V1.6siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationSiveillance Vantagesiemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationSolid Edge CAM Prosiemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationSolid Edge Wiring and Harness Designsiemens_psirt
Find detailed mitigation steps at: https://support.sw.siemens.com/en- US/knowledge-base/MG618363
MitigationSpectrum Power 4siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationSpectrum Power 7siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationTeamcenter Active Workspace V4.3siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationTeamcenter Active Workspace V5.0siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationTeamcenter Active Workspace V5.1siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationTeamcenter Active Workspace V5.2siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationTeamcenter Deployment Center V4.0siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationTeamcenter Deployment Center V4.1siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationTeamcenter Deployment Center V4.2siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationTeamcenter EDA V5.1siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationTeamcenter EDA V5.2siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationTeamcenter Integration Framework V13.0siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationTeamcenter Integration Framework V13.1siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationTeamcenter Integration Framework V13.2siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationTeamcenter Integration Framework V3.3siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationTeamcenter Integration Framework V4.0siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationTeamcenter Integration for CATIAsiemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationTeamcenter MBSE Gateway V4.1siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationTeamcenter MBSE Gateway V4.2siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationTeamcenter MBSE Gateway V4.3siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationTeamcenter MBSE Gateway V5.0siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationTeamcenter MBSE Gateway V5.1siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationTeamcenter MBSE Gateway V5.2siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationTeamcenter Microservices Framework V5.1siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationTeamcenter Microservices Framework V5.2siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationTeamcenter Reporting and Analytics V11siemens_psirt
Find detailed remediation and mitigation information at: https://support.sw.siemens.com/en-US/knowledge-base/PL8600700
MitigationTeamcenter Reporting and Analytics V12.2siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationTeamcenter Reporting and Analytics V12.3siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationTeamcenter Reporting and Analytics V12.4siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationTeamcenter Reporting and Analytics V13siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationTeamcenter Technical Publishingsiemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationTeamcenter V12.1siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationTeamcenter V12.2siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationTeamcenter V12.3siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationTeamcenter V12.4siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationTeamcenter V13.0siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationTeamcenter V13.1siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationTeamcenter V13.2siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationTeamcenter V13.3siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationTecnomatix Intositesiemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationTecnomatix Plant Simulationsiemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationTecnomatix Process Designersiemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationTecnomatix Process Simulatesiemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationTecnomatix Process Simulate VCLitesiemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationTecnomatix RobotExpertsiemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationTecnomatix eBOP Manager Serversiemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationValor Parts Library - VPL Directsiemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationValor Parts Library - VPL Server or Servicesiemens_psirt
Find detailed remediation and mitigation information at: https://support.sw.siemens.com/knowledge-base/MG618362
MitigationVeSys V2019.1siemens_psirt
Find detailed mitigation steps at: https://support.sw.siemens.com/en- US/knowledge-base/MG618363
MitigationVeSys V2020.1siemens_psirt
Find detailed mitigation steps at: https://support.sw.siemens.com/en- US/knowledge-base/MG618363
MitigationVeSys V2021.1siemens_psirt
Find detailed mitigation steps at: https://support.sw.siemens.com/en- US/knowledge-base/MG618363
MitigationXpedition Enterprise (XCR) VX.2.10siemens_psirt
Additional information is available at https://support.sw.siemens.com/en-US/product/1644094854/knowledge- base/MG618343
MitigationXpedition Enterprise VX.2.10siemens_psirt
Additional information is available at https://support.sw.siemens.com/en-US/product/1644094854/knowledge- base/MG618343
MitigationXpedition Enterprise VX.2.6siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationXpedition Enterprise VX.2.7siemens_psirt
Additional information is available at https://support.sw.siemens.com/en-US/product/1644094854/knowledge- base/MG618343
MitigationXpedition Enterprise VX.2.8siemens_psirt
Additional information is available at https://support.sw.siemens.com/en-US/product/1644094854/knowledge- base/MG618343
MitigationXpedition IC Packaging (XCR) VX.2.10siemens_psirt
Additional information is available at https://support.sw.siemens.com/en-US/product/1644094854/knowledge- base/MG618343
MitigationXpedition IC Packaging VX.2.10siemens_psirt
Additional information is available at https://support.sw.siemens.com/en-US/product/1644094854/knowledge- base/MG618343
MitigationXpedition IC Packaging VX.2.6siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationXpedition IC Packaging VX.2.7siemens_psirt
Additional information is available at https://support.sw.siemens.com/en-US/product/1644094854/knowledge- base/MG618343
MitigationXpedition IC Packaging VX.2.8siemens_psirt
Additional information is available at https://support.sw.siemens.com/en-US/product/1644094854/knowledge- base/MG618343
MitigationcRSPsiemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationcRSP Operator Client Startersiemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationjROS for Spectrum Power 4siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationjROS for Spectrum Power 7siemens_psirt
If the specific Siemens product allows it: Remove the JndiLookup class from the classpath: 'zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class'. This measure mitigates both CVE-2021-44228 and CVE-2021-45046. Note: in case you reinstall or update the product to a yet unfixed version later: check if the vulnerable JndiLookup class has to be removed again.
MitigationSPPA-T3000 SeS3000 Security Server (6DU7054-0..00-..A0)siemens_psirt
Ensure that SPPA-T3000 is set up according to the security concept defined in the SPPA-T3000 security manual
MitigationFirmware 4.2<4.8.1.4 installed on WAGO Smart Scriptwago_psirt
Do not use projects from untrusted sources. For further impact information and risk mitigation, see the recommendations of the Apache Foundation https://logging.apache.org/log4j/2.x/security.html Bundesamt für Sicherheit in der Informationstechnik (BSI) https://www.bsi.bund.de/DE/Service-Navi/Presse/Pressemitteilungen/Presse2021/211211_log4Shell_WarnstufeRot.html
MitigationExacq Enterprise Managercisa_csaf_ot
Johnson Controls recommends upgrading exacq Enterprise Manager to Version 21.12.1 or apply manual mitigation steps (available upon request).
https://exacq.com/support/downloads.php?section=esm
MitigationPowerManagecisa_csaf_ot
For more detailed mitigation instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2022-01 v1
https://www.johnsoncontrols.com/cyber-solutions/security-advisories
No fix availableTraceAlertServerPLUSsiemens_psirt
Currently no remediation is available
No fix availableSPPA-T3000 SeS3000 Security Server (6DU7054-0..00-..A0)siemens_psirt
Currently no remediation is available
No fix plannedVeSys V2019.1siemens_psirt
Currently no fix is planned

cvss

Technical severity, 0–10. One row per scoring source.

10.0

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 9.3–10

v2.09.3highAV:N/AC:M/Au:N/C:C/I:C/A:Cprimary · NVD / NIST USexploitability 8.6 · impact 10

v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 6

v3.010criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · CISA US

v3.110criticalAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · ENISA EU

v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondaryexploitability 3.9 · impact 6

v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:Hsecondary · OSV

v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H/RL:O/RC:Csecondary · Siemens ProductCERT DE

v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · WAGO PSIRT DE

v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · SICK PSIRT DE

v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)

v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · Cisco PSIRT US

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-20USCWE-20USCWE-20USCWE-20USCWE-20USCWE-20USCWE-400USCWE-400USCWE-400USCWE-502USCWE-502USCWE-502USCWE-502USCWE-917USCWE-917US

ATT&CK techniques

ATT&CK techniques this enables or maps to.

exploits (472)

Public proof-of-concept and weaponised exploit code.

exploit/linux/http/mobileiron_core_log4shellMobileIron Core Unauthenticated JNDI Injection RCE (via Log4Shell)weaponized · metasploit
exploit/multi/http/log4shell_header_injectionLog4Shell HTTP Header Injectionweaponized · metasploit
exploit/multi/http/ubiquiti_unifi_log4shellUniFi Network Application Unauthenticated JNDI Injection RCE (via Log4Shell)weaponized · metasploit
exploit/multi/http/vmware_vcenter_log4shellVMware vCenter Server Unauthenticated JNDI Injection RCE (via Log4Shell)weaponized · metasploit
auxiliary/scanner/http/log4shell_scannerLog4Shell HTTP Scannerfunctional · metasploit
EDB-50590Apache Log4j2 2.14.1 - Information DisclosurePoC · exploit_db

affected products (758)

Products and version ranges known to be affected.

ASC NEOall versionscert_bundDEcpe:/a:asc:neo:-
Amazon Linux 2all versionscert_bundDEcpe:/o:amazon:linux_2:-
Apache Kafkaall versionscert_bundDEcpe:/a:apache:kafka:-
Apache Solrall versionscert_bundDEcpe:/a:apache:solr:-
Apache Strutsall versionscert_bundDEcpe:/a:apache:struts:-
Apache log4j <2.16.0all versionscert_bundDE
Atlassian Bambooall versionscert_bundDEcpe:/a:atlassian:bamboo:-
Atlassian Bitbucketall versionscert_bundDEcpe:/a:atlassian:bitbucket:-
Atlassian Confluenceall versionscert_bundDEcpe:/a:atlassian:confluence:-
Atlassian Crucibleall versionscert_bundDEcpe:/a:atlassian:crucible:-
Atlassian Fisheyeall versionscert_bundDEcpe:/a:atlassian:fisheye:-
Atlassian Jira Softwareall versionscert_bundDEcpe:/a:atlassian:jira_software:-
Avaya Analyticsall versionscert_bundDEcpe:/a:avaya:analytics:-
Avaya Aura Application Enablement Servicesall versionscert_bundDEcpe:/a:avaya:aura_application_enablement_services:-
Avaya Aura Device Servicesall versionscert_bundDEcpe:/a:avaya:aura_device_services:-
Avaya Aura Experience Portalall versionscert_bundDEcpe:/a:avaya:aura_experience_portal:-
Avaya Aura Media Serverall versionscert_bundDEcpe:/a:avaya:media_server:-
Avaya Aura Session Managerall versionscert_bundDEcpe:/a:avaya:session_manager:-
Avaya Aura System Managerall versionscert_bundDEcpe:/a:avaya:aura_system_manager:-
Avaya Aura Web Gatewayall versionscert_bundDEcpe:/a:avaya:aura_web_gateway:-

showing 20 of 758

advisories (14)

Vendor and ecosystem advisories describing this.

SCA-2021-0003SICK Security Advisory for Apache Log4j (CVE-2021-44228)2021-12-14csaf · sick_psirtDE
As general security measures, SICK recommends to minimize network exposure of the devices, restrict network access and follow recommended security practices in order to run the devices in a protected IT environment.
SSA-397453SSA-397453: Apache Log4j Vulnerabilities (Log4Shell, CVE-2021-44228, CVE-2021-45046) - Impact to Siemens Energy TraceAlertServerPLUS2021-12-20csaf · siemens_psirtDE
On 2021-12-09, a vulnerability in Apache Log4j (a logging library used in many Java-based applications) was disclosed, that could allow remote unauthenticated attackers to execute code on vulnerable systems. The vulnerability is tracked as CVE-2021-44228 and is also known as "Log4Shell". On 2021-12-14 an additional denial of service vulnerability (CVE-2021-45046) was published rendering the initial mitigations and fix in version 2.15.0 as incomplete under certain non-default configurations. Log4j versions 2.16.0 and 2.12.2 are supposed to fix both vulnerabilities. On 2021-12-17, CVE-2021-45046 was reclassified with an increased CVSS base score (from 3.7 to 9.0). The potential impact of CVE-2021-45046 now includes - besides denial of service - also information disclosure and local (and potential remote) code execution. Siemens Energy is preparing updates and recommends specific countermeasures for TraceAlertServerPLUS.
SSA-479842SSA-479842: Apache Log4j Vulnerabilities - Impact to Siemens Energy Sensformer / Sensgear (Platform, Basic and Advanced)2021-12-21csaf · siemens_psirtDE
On 2021-12-09, a vulnerability in Apache Log4j (a logging tool used in many Java-based applications) was disclosed, that could allow remote unauthenticated attackers to execute code on vulnerable systems. The vulnerability is tracked as CVE-2021-44228 and is also known as "Log4Shell". On 2021-12-14 an additional denial of service vulnerability (CVE-2021-45046) was published rendering the initial mitigations and fix in version 2.15.0 as incomplete under certain non-default configurations. Log4j versions 2.16.0 and 2.12.2 are supposed to fix both vulnerabilities. On 2021-12-17, CVE-2021-45046 was reclassified with an increased CVSS base score (from 3.7 to 9.0). The potential impact of CVE-2021-45046 now includes - besides denial of service - also information disclosure and local (and potential remote) code execution. Furthermore, one additional denial of service vulnerability, CVE-2021-45105, was disclosed. The Siemens Energy Sensformer / Sensgear cloud service was affected by these vulnerabilities and has remediated them. No user actions are necessary.
SSA-661247SSA-661247: Apache Log4j Vulnerabilities (Log4Shell, CVE-2021-44228, CVE-2021-45046) - Impact to Siemens Products2021-12-13csaf · siemens_psirtDE
On 2021-12-09, a vulnerability in Apache Log4j (a logging tool used in many Java-based applications) was disclosed, that could allow remote unauthenticated attackers to execute code on vulnerable systems. The vulnerability is tracked as CVE-2021-44228 and is also known as "Log4Shell". On 2021-12-14 an additional denial of service vulnerability (CVE-2021-45046) was published rendering the initial mitigations and fix in version 2.15.0 as incomplete under certain non- default configurations. Log4j versions 2.16.0 and 2.12.2 are supposed to fix both vulnerabilities. On 2021-12-17, CVE-2021-45046 was reclassified with an increased CVSS base score (from 3.7 to 9.0). The potential impact of CVE-2021-45046 now includes - besides denial of service - also information disclosure and local (and potential remote) code execution. Siemens is currently investigating to determine which products are affected and is continuously updating this advisory as more information becomes available. See section Additional Information for more details regarding the investigation status. Note: two additional vulnerabilities were published for Apache Log4j, the impact of which are documented in SSA-501673: https://cert- portal.siemens.com/productcert/pdf/ssa-501673.pdf (CVE-2021-45105) and SSA-784507: https://cert- portal.siemens.com/productcert/pdf/ssa-784507.pdf (CVE-2021-44832).
SSA-714170SSA-714170: Apache Log4j Vulnerabilities (Log4Shell, CVE-2021-44228, CVE-2021-45046) - Impact to SPPA-T30002021-12-16csaf · siemens_psirtDE
On 2021-12-09, a vulnerability in Apache Log4j (a logging library used in many Java-based applications) was disclosed, that could allow remote unauthenticated attackers to execute code on vulnerable systems. The vulnerability is tracked as CVE-2021-44228 and is also known as "Log4Shell". On 2021-12-14 an additional denial of service vulnerability (CVE-2021-45046) was published rendering the initial mitigations and fix in version 2.15.0 as incomplete under certain non-default configurations. Log4j versions 2.16.0 and 2.12.2 are supposed to fix both vulnerabilities. On 2021-12-17, CVE-2021-45046 was reclassified with an increased CVSS base score (from 3.7 to 9.0). The potential impact of CVE-2021-45046 now includes - besides denial of service - also information disclosure and local (and potential remote) code execution. Siemens Energy is preparing updates and recommends specific countermeasures for SPPA-T3000.
VDE-2021-060WAGO: Smart Script affected by Log4Shell Vulnerability2022-01-05csaf · wago_psirtDE
Apache Log4j is used for logging events in WAGO Smart Script in Version 4.2 and higher. Events logged by Log4j can contain JNDI references. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. Additionally, Log4j does not protect from self-referential lookups, which can lead to Denial of Service. UPDATE A1/2: Affected versions: CVE-2021-44228 and CVE-2021-45046: WAGO Smart Script >= Version 4.2 and < Version 4.8.1.3 CVE-2021-45105: WAGO Smart Script >= Version 4.2 and < Version 4.8.1.4 CVE-2021-44832 WAGO Smart Script >= Version 4.2 and < Version 4.8.1.5 END UPDATE A1/2
WID-SEC-W-2022-0351Apache log4j: Schwachstelle ermöglicht CodeausführungDeutsch2021-12-09csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Apache log4j ausnutzen, um beliebigen Programmcode auszuführen.
WID-SEC-W-2023-0063Juniper Junos Space: Mehrere SchwachstellenDeutsch2022-01-12csaf · cert_bundDE
Ein Angreifer aus dem angrenzenden Netzwerk oder ein entfernter anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in Juniper Junos Space ausnutzen, um Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand auszulösen, beliebigen Code auszuführen und seine Privilegien zu erweitern.
WID-SEC-W-2024-0064Juniper Produkte: Mehrere SchwachstellenDeutsch2024-01-10csaf · cert_bundDE
Ein Angreifer aus dem angrenzenden Netzwerk oder ein entfernter, anonymer, authentisierter, lokaler oder physischer Angreifer kann mehrere Schwachstellen in Juniper JUNOS, Juniper JUNOS Evolved, Juniper SRX Series, Juniper EX Series, Juniper QFX Series, Juniper ACX Series, Juniper PTX Series und Juniper MX Series ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuführen und seine Berechtigungen zu erweitern.
cisco-sa-apache-log4j-qRuKNEbdVulnerabilities in Apache Log4j Library Affecting Cisco Products: December 20212021-12-10csaf · cisco_csafUS
Critical Vulnerabilities in Apache Log4j Java Logging Library On December 9, 2021, the following critical vulnerability in the Apache Log4j Java logging library affecting all Log4j2 versions earlier than 2.15.0 was disclosed: CVE-2021-44228: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints On December 14, 2021, the following critical vulnerability, which affects certain Apache Log4j use cases in versions 2.15.0 and earlier, was disclosed: CVE-2021-45046: Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack On December 18, 2021, a vulnerability in the Apache Log4j component affecting versions 2.16 and earlier was disclosed: CVE-2021-45105: Apache Log4j2 does not always protect from infinite recursion in lookup evaluation On December 28, 2021, a vulnerability in the Apache Log4j component affecting versions 2.17 and earlier was disclosed: CVE-2021-44832: Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration For a description of these vulnerabilities, see the Apache Log4j Security Vulnerabilities ["https://logging.apache.org/log4j/2.x/security.html"] page. Cisco's Response to These Vulnerabilities Cisco assessed all products and services for impact from both CVE-2021-44228 and CVE-2021-45046. To help detect exploitation of these vulnerabilities, Cisco has released Snort rules at the following location: Talos Rules 2021-12-21 ["https://www.snort.org/advisories/talos-rules-2021-12-21"] Product fixes that are listed in this advisory will address both CVE-2021-44228 and CVE-2021-45046 unless otherwise noted. Cisco has reviewed CVE-2021-45105 and CVE-2021-44832 and has determined that no Cisco products or cloud offerings are impacted by these vulnerabilities. Cisco's standard practice is to update integrated third-party software components to later versions as they become available.
GHSA-jfh8-c2jp-5v3qRemote code injection in Log4j2021-12-10ghsa · osvUS
# Summary Log4j versions prior to 2.16.0 are subject to a remote code execution vulnerability via the ldap JNDI parser. As per [Apache's Log4j security guide](https://logging.apache.org/log4j/2.x/security.html): Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.16.0, this behavior has been disabled by default. Log4j version 2.15.0 contained an earlier fix for the vulnerability, but that patch did not disable attacker-controlled JNDI lookups in all situations. For more information, see the `Updated advice for version 2.16.0` section of this advisory. # Impact Logging untrusted or user controlled data with a vulnerable version of Log4J may result in Remote Code Execution (RCE) against your application. This includes untrusted data included in logged errors such as exception traces, authentication failures, and other unexpected vectors of user controlled input. # Affected versions Any Log4J version prior to v2.15.0 is affected to this specific issue. The v1 branch of Log4J which is considered End Of Life (EOL) is vulnerable to other RCE vectors so the recommendation is to still update to 2.16.0 where possible. ## Security releases Additional backports of this fix have been made available in versions 2.3.1, 2.12.2, and 2.12.3 ## Affected packages Only the `org.apache.logging.log4j:log4j-core` package is directly affected by this vulnerability. The `org.apache.logging.log4j:log4j-api` should be kept at the same version as the `org.apache.logging.log4j:log4j-core` package to ensure compatability if in use. # Remediation Advice ## Updated advice for version 2.16.0 The Apache Logging Services team provided updated mitigation advice upon the release of version 2.16.0, which [disables JNDI by default and completely removes support for message lookups](https://logging.apache.org/log4j/2.x/changes-report.html#a2.16.0). Even in version 2.15.0, lookups used in layouts to provide specific pieces of context information will still recursively resolve, possibly triggering JNDI lookups. This problem is being tracked as [CVE-2021-45046](https://nvd.nist.gov/vuln/detail/CVE-2021-45046). More information is available on the [GitHub Security Advisory for CVE-2021-45046](https://github.com/advisories/GHSA-7rjr-3q55-vv33). Users who want to avoid attacker-controlled JNDI lookups but cannot upgrade to 2.16.0 must [ensure that no such lookups resolve to attacker-provided data and ensure that the the JndiLookup class is not loaded](https://issues.apache.org/jira/browse/LOG4J2-3221). Please note that Log4J v1 is End Of Life (EOL) and will not receive patches for this issue. Log4J v1 is also vulnerable to other RCE vectors and we recommend you migrate to Log4J 2.16.0 where possible.
ICSA-21-357-02Johnson Controls exacq Enterprise Manager2021-12-23icsa · cisa_csaf_otUS
Successful exploitation of this vulnerability could allow an attacker to enter malicious input resulting in remote code execution.
ICSA-22-034-01Sensormatic PowerManage (Update A)2022-02-03icsa · cisa_csaf_otUS
Successful exploitation of this vulnerability could allow an attacker to gain remote code execution.
CERTFR-2026-AVI-1336Multiples vulnérabilités dans les produits IBMFrançais2026-10-16vendor · certfrFR

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund sick_psirt siemens_psirt wago_psirt cisco_csaf osv cisa_csaf_ot certfr NVD CVE.org MITRE

published 2021-12-10modified 2026-08-12

references (232)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan