CVE-2021-44524

highpriority · track · 40EPSS 0.016 · 76 %ileDEEUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
1.63% (76th) EPSS
CVSS 7.5 · high
Is it mine?
25 products
Check your exposure
Who says so?
5 sources
cnnvd · enisa_euvd · cisa_csaf_ot · nvd

EPSS · scored 2026-10-27

A vulnerability has been identified in SiPass integrated V2.76 (All versions), SiPass integrated V2.80 (All versions), SiPass integrated V2.85 (All versions), Siveillance Identity V1.5 (All versions), Siveillance Identity V1.6 (All versions < V1.6.284.0). Affected applications insufficiently limit the access to the internal user authentication service. This could allow an unauthenticated remote attacker to trigger several actions on behalf of valid user accounts.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • FixedSiPass integrated V2.76siemens_psirt

    Update to V2.76 SP2 and then download and execute the SiPass integrated Component Manager: https://support.industry.siemens.com/cs/ww/en/view/109802587/

  • FixedSiPass integrated V2.80siemens_psirt

    Download and execute the SiPass integrated Component Manager: https://support.industry.siemens.com/cs/ww/en/view/109802587/

  • FixedSiPass integrated V2.85siemens_psirt

    Download and execute the SiPass integrated Component Manager: https://support.industry.siemens.com/cs/ww/en/view/109802587/

  • FixedSiveillance Identity V1.5siemens_psirt

    Update to V1.5 SP4 and apply the Credential Patch Tool: https://support.industry.siemens.com/cs/ww/en/view/109801824/

  • FixedSiveillance Identity V1.6siemens_psirt

    Update to V1.6.284.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109801819/
  • FixedSiveillance Identity V1.5cisa_csaf_ot

    Update to V1.5 SP4 and apply the Credential Patch Tool: https://support.industry.siemens.com/cs/ww/en/view/109801824/

  • FixedSiveillance Identity V1.6cisa_csaf_ot

    Update to V1.6.284.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109801819/
  • FixedSiPass integrated V2.76cisa_csaf_ot

    Update to V2.76 SP2 and then download and execute the SiPass integrated Component Manager: https://support.industry.siemens.com/cs/ww/en/view/109802587/

  • FixedSiPass integrated V2.80cisa_csaf_ot

    Download and execute the SiPass integrated Component Manager: https://support.industry.siemens.com/cs/ww/en/view/109802587/

  • FixedSiPass integrated V2.85cisa_csaf_ot

    Download and execute the SiPass integrated Component Manager: https://support.industry.siemens.com/cs/ww/en/view/109802587/

02

cvss

Technical severity, 0–10. One row per scoring source.

9.8
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.5–9.8

v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 10 · impact 6.4
v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:Csecondary · CISA US
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:Csecondary · Siemens ProductCERT DE
v3.19criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)
03

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-287USprimaryCWE-668USCWE-668USCWE-668US
04

affected products (25)

Products and version ranges known to be affected.

showing 20 of 25
05

advisories (4)

Vendor and ecosystem advisories describing this.

  • SSA-160202SSA-160202: Multiple Access Control Vulnerabilities in SiPass Integrated2021-12-14csaf · siemens_psirtDE

    SiPass integrated contains multiple vulnerabilities that could allow an unauthenticated remote attacker to access or modify several internal application resources. Siemens has released a tool, "SiPass integrated Component Manager", to remediate the vulnerabilities on all maintained and supported versions of SiPass integrated and recommends to apply this tool.

  • SSA-463116SSA-463116: Multiple Access Control Vulnerabilities in Siveillance Identity before V1.6.284.02021-12-14csaf · siemens_psirtDE

    Siveillance Identity contains multiple vulnerabilities that could allow an unauthenticated remote attacker to access or modify several internal application resources. Siemens has released updates for the affected products and recommends to update to the latest versions.

  • ICSA-21-350-14Siemens Siveillance Identity2021-12-14icsa · cisa_csaf_otUS

    Siveillance Identity contains multiple vulnerabilities that could allow an unauthenticated remote attacker to access or modify several internal application resources. Siemens has released updates for the affected products and recommends to update to the latest versions.

  • ICSA-21-350-19Siemens SiPass Integrated2021-12-14icsa · cisa_csaf_otUS

    SiPass integrated contains multiple vulnerabilities that could allow an unauthenticated remote attacker to access or modify several internal application resources. Siemens has released a tool, "SiPass integrated Component Manager", to remediate the vulnerabilities on all maintained and supported versions of SiPass integrated and recommends to apply this tool.

06

also known as (3)

Other names and identifiers for this entity.

07

sources

Which sources assert this record, and when.

cnnvdenisa_euvdcisa_csaf_otnvdsiemens_psirtNVDCVE.orgMITRE
published 2021-12-14modified 2026-06-17
09

references (9)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan