CVE-2021-45046
mediumpriority · act · 90OT risk · criticalKEV · exploitedEPSS 1.000 · 100 %ileexploit · functionalDEEURUUSadded 2023-05-01remediate by 2023-05-22
required action Apply updates per vendor instructions.
EPSS · scored 2026-10-22
Apache Log4j2 Deserialization of Untrusted Data Vulnerability
It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedSensformer / Sensgear Platformsiemens_psirt
Vulnerabilities fixed on central cloud service between 2021-12-10 (CVE-2021-44228) and 2021-12-21 (CVE-2021-45105); no user actions necessary
- FixedAdvantage Navigator Energy & Sustainabilitysiemens_psirt
Vulnerability CVE-2021-44228 fixed on central cloud service starting 2021-12-13; no user actions necessary
- FixedAdvantage Navigator Software Proxy V6siemens_psirt
Update to V6.3 or later version
- FixedBuilding Operator Discovery Distribution for the Connect X200 Gatewaysiemens_psirt
Update to V3.0.30 or later version
https://support.industry.siemens.com/cs/ww/en/view/109805593/ - FixedBuilding Operator Discovery Distribution for the Connect X300 Gatewaysiemens_psirt
Update to V3.0.29 or later version
https://support.industry.siemens.com/cs/ww/en/view/109805593/ - FixedBuilding Twin - 360° Viewersiemens_psirt
Vulnerability CVE-2021-44228 fixed on central cloud service; no user actions necessary
- FixedCOMOSsiemens_psirt
Update to V10.4.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812011/ - FixedCapital V2019.1siemens_psirt
Update to V2019.1 SP2204 or later version
https://support.sw.siemens.com/en- US/product/861057055/downloads - FixedCapital V2020.1siemens_psirt
Update to V2020.1 SP2202 or later version
https://support.sw.siemens.com/en- US/product/861057055/downloads - FixedCapital V2021.1siemens_psirt
Update to V2021.1 SP2202 or later version
https://support.sw.siemens.com/en- US/product/861057055/downloads - FixedCerberus DMS V5.0siemens_psirt
Remove the JndiLookup class from the classpath. Detailed instructions are available at https://support.industry.siemens.com/cs/ww/en/view/109805562/
- FixedCerberus DMS V5.1siemens_psirt
Remove the JndiLookup class from the classpath. Detailed instructions are available at https://support.industry.siemens.com/cs/ww/en/view/109805562/
- FixedDesigo CC V3.0siemens_psirt
Remove the JndiLookup class from the classpath. Detailed instructions are available at https://support.industry.siemens.com/cs/ww/en/view/109805562/
- FixedDesigo CC V4.0siemens_psirt
Remove the JndiLookup class from the classpath. Detailed instructions are available at https://support.industry.siemens.com/cs/ww/en/view/109805562/
- FixedDesigo CC V4.1siemens_psirt
Remove the JndiLookup class from the classpath. Detailed instructions are available at https://support.industry.siemens.com/cs/ww/en/view/109805562/
- FixedDesigo CC V4.2siemens_psirt
Remove the JndiLookup class from the classpath. Detailed instructions are available at https://support.industry.siemens.com/cs/ww/en/view/109805562/
- FixedDesigo CC V5.0siemens_psirt
Remove the JndiLookup class from the classpath. Detailed instructions are available at https://support.industry.siemens.com/cs/ww/en/view/109805562/
- FixedDesigo CC V5.1siemens_psirt
Update to V5.1 QU1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109807893/ - FixedE-Car OC Cloud Applicationsiemens_psirt
Vulnerability CVE-2021-44228 fixed on central cloud service starting 2021-12-13; no user actions necessary
- FixedEnergy Engagesiemens_psirt
Find detailed remediation and mitigation information on the EnergyIP docs portal at: https://docs.emeter.com/display/public/WELCOME/Energy IP+Security+Advisory+for+Log4Shell+Vulnerability
- FixedEnergyIPsiemens_psirt
Find detailed remediation and mitigation information on the EnergyIP docs portal at: https://docs.emeter.com/display/public/WELCOME/Energy IP+Security+Advisory+for+Log4Shell+Vulnerability
- FixedEnlighted Amazesiemens_psirt
Vulnerabilities fixed on central cloud services starting 2021-12-10; no user actions necessary
- FixedEnlighted Wheresiemens_psirt
Vulnerabilities fixed on central cloud services starting 2021-12-11; no user actions necessary
- FixedGMA-Managersiemens_psirt
Update to V8.6.2.472 or later version
https://support.industry.siemens.com/cs/ww/en/view/109805665/ - FixedGeolus Shape Search V10siemens_psirt
Remove the JndiLookup class from the classpath.
- FixedGeolus Shape Search V11siemens_psirt
Remove the JndiLookup class from the classpath.
- FixedHEEDS Connectsiemens_psirt
HEEDS Connect team will contact all impacted customers to deploy a new log4j version. This action will secure your installation against Log4Shell vulnerability. For further information see: https://support.sw.siemens.com/en-US/knowledge-base/PL8601661
- FixedHES UDISsiemens_psirt
Specific fix versions based on V6.0.2 and V6.0.3 were released and deployed for all affected projects
- FixedIndustrial Edge Hubsiemens_psirt
Vulnerabilities fixed on central cloud service starting 2021-12-13; no user actions necessary
- FixedIndustrial Edge Management App (IEM-App)siemens_psirt
Update to V1.4.11 or later version
https://iehub.eu1.edge.siemens.cloud/ - FixedIndustrial Edge Management OS (IEM-OS)siemens_psirt
Update to V1.4.0-42 or later version
https://iehub.eu1.edge.siemens.cloud/ - FixedMendix Applicationssiemens_psirt
Although the Mendix runtime itself is not vulnerable to this exploit, we nevertheless recommend to upgrade log4j-core to the latest available version if log4j-core is part of your project. This advice is regardless of the JRE/JDK version the app runs on.
https://status.mendix.com/incidents/8j5043my610c - FixedMindSphere App Management Cockpits (Developer& Operator)siemens_psirt
Vulnerabilities fixed with update on 2021-12-16; no user actions necessary
- FixedMindSphere Asset Managersiemens_psirt
Vulnerabilities fixed with update on 2021-12-16; no user actions necessary
- FixedMindSphere IAM (User Management/ Settings)siemens_psirt
Vulnerabilities fixed with update on 2021-12-16; no user actions necessary
- FixedMindSphere Integrated Data Lakesiemens_psirt
Vulnerabilities fixed with update on 2021-12-16; no user actions necessary
- FixedMindSphere Notification Servicesiemens_psirt
Vulnerabilities fixed with update on 2021-12-16; no user actions necessary
- FixedMindSphere Predictive Learningsiemens_psirt
Vulnerabilities fixed with update on 2021-12-23; no user actions necessary
- FixedMindSphere Usage Transparency Servicesiemens_psirt
Vulnerabilities fixed with update on 2021-12-16; no user actions necessary
- FixedMindSphere Visual Explorersiemens_psirt
Vulnerabilities fixed with update on 2021-12-21; no user actions necessary
- FixedMindsphere Cloud Foundrysiemens_psirt
Although the Cloud Foundry environment itself is not vulnerable to this exploit, we nevertheless recommend to upgrade log4j-core to the latest available version if log4j-core is part of your project. https://support.sw.siemens.com/en-US/product/268530510/knowledge- base/PL8600797
- FixedMindsphere Cloud Platformsiemens_psirt
Vulnerabilities fixed on central cloud service starting 2021-12-11; no user actions necessary
- FixedNX 1953 Seriessiemens_psirt
Update to V1973.4340 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600959 - FixedNX 1980 Seriessiemens_psirt
Update to V2000.3400 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600959 - FixedNX 2007 Seriessiemens_psirt
Update to V2008 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600959 - FixedNXpower Monitorsiemens_psirt
Vulnerabilities fixed on central cloud service starting 2021-12-19; no user actions necessary
- FixedOpcenter EX CP Process Automation Controlsiemens_psirt
Update to V18.1 or later version to fix CVE-2021-44228
- FixedOpcenter Execution Core Process Automation Controlsiemens_psirt
Update to V18.1 or later version to fix CVE-2021-44228
- FixedOpcenter Intelligencesiemens_psirt
Update to V3.5 or later version
https://support.sw.siemens.com/ - FixedOperation Schedulersiemens_psirt
Update the UAA component to V75.8.3
https://support.industry.siemens.com/cs/ww/en/view/109805673/ - FixedSENTRON powermanager V4siemens_psirt
Remove the JndiLookup class from the classpath. Detailed instructions are available at https://support.industry.siemens.com/cs/ww/en/view/109805602/
- FixedSIGUARD DSAsiemens_psirt
Update to V4.4.1 or later version
- FixedSIMATIC IPC1047siemens_psirt
Update the driver for the SmartRAID controller to V2.6.6 or later version, available at https://storage.microsemi.com/en- us/support/raid/sas_raid/asr-3151-4i/
- FixedSIMATIC IPC1047Esiemens_psirt
Update the driver for the SmartRAID controller to V2.6.6 or later version, available at https://storage.microsemi.com/en- us/support/raid/sas_raid/asr-3151-4i/
- FixedSIMATIC IPC647Dsiemens_psirt
Follow the remediation steps documented at https://ask.adaptec.com/app/answers/detail/a_id/17527/
- FixedSIMATIC IPC647Esiemens_psirt
Update the driver for the SmartRAID controller to V2.6.6 or later version, available at https://storage.microsemi.com/en- us/support/raid/sas_raid/asr-3151-4i/
- FixedSIMATIC IPC847Dsiemens_psirt
Follow the remediation steps documented at https://ask.adaptec.com/app/answers/detail/a_id/17527/
- FixedSIMATIC IPC847Esiemens_psirt
Update the driver for the SmartRAID controller to V2.6.6 or later version, available at https://storage.microsemi.com/en- us/support/raid/sas_raid/asr-3151-4i/
- FixedSiPass integrated V2.80siemens_psirt
Apply the patch
https://support.industry.siemens.com/cs/ww/en/view/109805711/ - FixedSiPass integrated V2.85siemens_psirt
Update to V2.85.7.5 or later version
https://support.industry.siemens.com/cs/ww/en/view/109801507/ - FixedSimcenter 3Dsiemens_psirt
Update to 2022.1-2008 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8603477 - FixedSimcenter Amesimsiemens_psirt
Update Teamcenter to any fix version available for the different version lines of Teamcenter, see https://support.sw.siemens.com/en- US/knowledge-base/PL8600700
https://support.sw.siemens.com/en-US/knowledge- base/PL8601572 - FixedSimcenter System Architectsiemens_psirt
Update Teamcenter to any fix version available for the different version lines of Teamcenter, see https://support.sw.siemens.com/en- US/knowledge-base/PL8600700
https://support.sw.siemens.com/en-US/knowledge- base/PL8601662 - FixedSimcenter System Simulation Client for Gitsiemens_psirt
Update to V2021.2.2 or later version
https://support.sw.siemens.com - FixedSimcenter Testlabsiemens_psirt
Follow the remediation steps documented at: https://support.sw.siemens.com/en-US/knowledge-base/PL8602466
- FixedSimcenter Testlab Data Managementsiemens_psirt
Simcenter Testlab Data Management team will contact all impacted customer to deploy the mitigation measures. This action will secure your installation against Log4Shell vulnerability. For further information see: https://support.sw.siemens.com/en-US/knowledge- base/PL8601418
- FixedSiveillance Commandsiemens_psirt
Vulnerabilities fixed for Command installations on a project basis; no user actions necessary
- FixedSiveillance Control Pro V2.1siemens_psirt
A hotfix is available; please contact customer support to receive the hotfix
- FixedSiveillance Control Pro V2.2siemens_psirt
Update to V2.2.7 or later version; please contact customer support to receive the latest version
- FixedSiveillance Control Pro V2.3siemens_psirt
Update to V2.3.2 or later version; please contact customer support to receive the latest version
- FixedSiveillance Identity V1.5siemens_psirt
Update to V1.5 SP4 and apply the patch
https://support.industry.siemens.com/cs/ww/en/view/109805657/ - FixedSiveillance Identity V1.6siemens_psirt
Update to V1.6 SP1 and apply the patch
https://support.industry.siemens.com/cs/ww/en/view/109805657/ - FixedSiveillance Vantagesiemens_psirt
Vulnerabilities fixed for Vantage installations on a project basis; no user actions necessary
- FixedSolid Edge CAM Prosiemens_psirt
Update to V2008 or later version
https://support.sw.siemens.com/ - FixedSolid Edge Wiring and Harness Designsiemens_psirt
Update to V2022 SP2202 or later version
https://support.sw.siemens.com/en- US/product/246738425/downloads - FixedSpectrum Power 4siemens_psirt
Update to V4.70 SP9 and apply Security Patch 1. Please contact your local Siemens representative.
- FixedSpectrum Power 7siemens_psirt
Update to V21Q4 and apply the patch. Please contact your local Siemens representative.
- FixedTeamcenter Active Workspace V4.3siemens_psirt
Update to V4.3.13 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - FixedTeamcenter Active Workspace V5.0siemens_psirt
Update to V5.0.11 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - FixedTeamcenter Active Workspace V5.1siemens_psirt
Update to V5.1.8 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - FixedTeamcenter Active Workspace V5.2siemens_psirt
Update to V5.2.6 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - FixedTeamcenter Deployment Center V4.0siemens_psirt
Update to V4.0.3 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - FixedTeamcenter Deployment Center V4.1siemens_psirt
Update to V4.1.1.1 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - FixedTeamcenter Deployment Center V4.2siemens_psirt
Update to V4.2.0.2 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - FixedTeamcenter EDA V5.1siemens_psirt
Update to V5.1.5 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - FixedTeamcenter EDA V5.2siemens_psirt
Update to V5.2.3 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - FixedTeamcenter Integration Framework V13.0siemens_psirt
Update to V13.0.0.2 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - FixedTeamcenter Integration Framework V13.1siemens_psirt
Update to V13.1.0.1 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - FixedTeamcenter Integration Framework V13.2siemens_psirt
Update to V13.2.0.1 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - FixedTeamcenter Integration Framework V3.3siemens_psirt
Update to V3.3.0.7 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - FixedTeamcenter Integration Framework V4.0siemens_psirt
Update to V4.0.0.2 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - FixedTeamcenter Integration for CATIAsiemens_psirt
Update to V13.0.1.2 or later version
https://support.sw.siemens.com/knowledge- base/PL8602463 - FixedTeamcenter MBSE Gateway V4.1siemens_psirt
Update to V4.1.2 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - FixedTeamcenter MBSE Gateway V4.2siemens_psirt
Update to V4.2.3 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - FixedTeamcenter MBSE Gateway V4.3siemens_psirt
Update to V4.3.3 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - FixedTeamcenter MBSE Gateway V5.0siemens_psirt
Update to V5.0.6 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - FixedTeamcenter MBSE Gateway V5.1siemens_psirt
Update to V5.1.5 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - FixedTeamcenter MBSE Gateway V5.2siemens_psirt
Update to V5.2.4 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - FixedTeamcenter Microservices Framework V5.1siemens_psirt
Update to V5.1.8 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - FixedTeamcenter Microservices Framework V5.2siemens_psirt
Update to V5.2.6 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - FixedTeamcenter Reporting and Analytics V11siemens_psirt
Remove the JndiLookup class from the classpath.
- FixedTeamcenter Reporting and Analytics V12.2siemens_psirt
Update to V12.2.8 or later version
https://support.sw.siemens.com/enUS/knowledge- base/PL8600700 - FixedTeamcenter Reporting and Analytics V12.3siemens_psirt
Update to V12.3.11 or later version
https://support.sw.siemens.com/enUS/knowledge- base/PL8600700 - FixedTeamcenter Reporting and Analytics V12.4siemens_psirt
Update to V12.4.1 or later version
https://support.sw.siemens.com/enUS/knowledge- base/PL8600700 - FixedTeamcenter Reporting and Analytics V13siemens_psirt
Update to V13.2.1.1 or V13.3.0.0 or later version
https://support.sw.siemens.com/enUS/knowledge- base/PL8600700 - FixedTeamcenter Technical Publishingsiemens_psirt
Update to V13.0.1 or later version
https://support.sw.siemens.com/knowledge- base/PL8612040 - FixedTeamcenter V12.1siemens_psirt
Update to V12.1.0.14 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - FixedTeamcenter V12.2siemens_psirt
Update to V12.2.0.18 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - FixedTeamcenter V12.3siemens_psirt
Update to V12.3.0.15 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - FixedTeamcenter V12.4siemens_psirt
Update to V12.4.0.12 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - FixedTeamcenter V13.0siemens_psirt
Update to V13.0.0.9 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - FixedTeamcenter V13.1siemens_psirt
Update to V13.1.0.8 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - FixedTeamcenter V13.2siemens_psirt
Update to V13.2.0.6 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - FixedTeamcenter V13.3siemens_psirt
Update to V13.3.0.1 or later version
https://support.sw.siemens.com/en-US/knowledge- base/PL8600700 - FixedTecnomatix Intositesiemens_psirt
Vulnerabilities fixed on central cloud service; no user actions necessary
- FixedTecnomatix Plant Simulationsiemens_psirt
Download and install the updated TCCS setup from the Siemens Support Center; for details see https://support.sw.siemens.com/knowledge- base/PL8615527
- FixedTecnomatix Process Designersiemens_psirt
Apply the hotfix, available for versions V14.1, V15.0, V15.1, V15.1.2, V16.0, V16.0.1, V16.0.2, V16.1, V16.1.1, V16.1.2
https://support.sw.siemens.com/en-US/knowledge- base/PL8602057 - FixedTecnomatix Process Simulatesiemens_psirt
Apply the hotfix, available for versions V14.1, V15.0, V15.1, V15.1.2, V16.0, V16.0.1, V16.0.2, V16.1, V16.1.1, V16.1.2
https://support.sw.siemens.com/en-US/knowledge- base/PL8602057 - FixedTecnomatix Process Simulate VCLitesiemens_psirt
Apply the hotfix, available for versions V14.1, V15.0, V15.1, V15.1.2, V16.0, V16.0.1, V16.0.2, V16.1, V16.1.1, V16.1.2
https://support.sw.siemens.com/en-US/knowledge- base/PL8602057 - FixedTecnomatix RobotExpertsiemens_psirt
Apply the hotfix, available for versions V14.1, V15.0, V15.1, V15.1.2, V16.0, V16.0.1, V16.0.2, V16.1, V16.1.1, V16.1.2
https://support.sw.siemens.com/en-US/knowledge- base/PL8602057 - FixedTecnomatix eBOP Manager Serversiemens_psirt
Apply the hotfix
https://support.sw.siemens.com/en-US/knowledge- base/PL8602057 - FixedValor Parts Library - VPL Directsiemens_psirt
Vulnerabilities fixed on remote VPL server; no user actions necessary
- FixedValor Parts Library - VPL Server or Servicesiemens_psirt
Remove the JndiLookup class from the classpath.
- FixedVeSys V2020.1siemens_psirt
Update to V2020.1 SP2202 or later version
https://support.sw.siemens.com/en- US/product/852852123/downloads - FixedVeSys V2021.1siemens_psirt
Update to V2021.1 SP2202 or later version
https://support.sw.siemens.com/en- US/product/852852123/downloads - FixedXpedition Enterprise (XCR) VX.2.10siemens_psirt
Update to VX.2.10 Update 4 or later version
https://support.sw.siemens.com/en-US/product/1644094854/download/2022 01034 - FixedXpedition Enterprise VX.2.10siemens_psirt
Update to VX.2.10 Update 4 or later version
https://support.sw.siemens.com/en-US/product/852852130/download/20220 1033 - FixedXpedition Enterprise VX.2.6siemens_psirt
Apply the hotfix
https://support.sw.siemens.com/en-US/product/1644094854/knowledge- base/MG618343 - FixedXpedition Enterprise VX.2.7siemens_psirt
Update to VX.2.7 Update 19 or later version
https://support.sw.siemens.com/en-US/product/852852130/download/20220 1039 - FixedXpedition Enterprise VX.2.8siemens_psirt
Update to VX.2.8 Update 13 or later version
https://support.sw.siemens.com/en-US/product/852852130/download/20220 1037 - FixedXpedition IC Packaging (XCR) VX.2.10siemens_psirt
Update to VX.2.10 Update 4 or later version
https://support.sw.siemens.com/en-US/product/1644094857/download/2022 01036 - FixedXpedition IC Packaging VX.2.10siemens_psirt
Update to VX.2.10 Update 4 or later version
https://support.sw.siemens.com/en-US/product/1091814625/download/2022 01035 - FixedXpedition IC Packaging VX.2.6siemens_psirt
Apply the hotfix
https://support.sw.siemens.com/en-US/product/1644094854/knowledge- base/MG618343 - FixedXpedition IC Packaging VX.2.7siemens_psirt
Update to VX.2.7 Update 19 or later version
https://support.sw.siemens.com/en-US/product/1091814625/download/2022 01040 - FixedXpedition IC Packaging VX.2.8siemens_psirt
Update to VX.2.8 Update 13 or later version
https://support.sw.siemens.com/en-US/product/1091814625/download/2022 01038 - FixedcRSPsiemens_psirt
Update to V13.17.2 was deployed on all cRSP services on 2021-12-21; no user actions necessary
- FixedcRSP Operator Client Startersiemens_psirt
Update to V1.7.18 or later version, as provided via cRSP V13.17.2 or later version
- FixedjROS for Spectrum Power 4siemens_psirt
Update to V4.70 SP9 Security Patch 1 or later version. Please contact your local Siemens representative.
- FixedjROS for Spectrum Power 7siemens_psirt
Apply the patch. Please contact your local Siemens representative.
- FixedFirmware 4.2<4.8.1.4 installed on WAGO Smart Scriptwago_psirt
UPDATE A2/2:Install Version 4.8.1.5 or later of WAGO Smart Script, which is available on our Website.Customers using Version 4.6 or higher can already use the integrated 'Check for update' function of WAGO Smart Script to update to Version 4.8.1.5.END UPDATE A2/2
- FixedCisco Evolved Programmable Network Manager (EPNM)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Network Services Orchestratorcisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Unified Communications Manager / Cisco Unity Connectioncisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - FixedCisco Unified Communications Manager IM and Presence Servicecisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - MitigationTraceAlertServerPLUSsiemens_psirt
Check file system permissions
- MitigationAdvantage Navigator Energy & Sustainabilitysiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationAdvantage Navigator Software Proxy V6siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationBuilding Operator Discovery Distribution for the Connect X200 Gatewaysiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationBuilding Operator Discovery Distribution for the Connect X300 Gatewaysiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationBuilding Twin - 360° Viewersiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationCOMOSsiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationCapital V2019.1siemens_psirt
Find detailed mitigation steps at: https://support.sw.siemens.com/en- US/knowledge-base/MG618363
- MitigationCapital V2020.1siemens_psirt
Find detailed mitigation steps at: https://support.sw.siemens.com/en- US/knowledge-base/MG618363
- MitigationCapital V2021.1siemens_psirt
Find detailed mitigation steps at: https://support.sw.siemens.com/en- US/knowledge-base/MG618363
- MitigationCerberus DMS V5.0siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationCerberus DMS V5.1siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationDesigo CC V3.0siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationDesigo CC V4.0siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationDesigo CC V4.1siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationDesigo CC V4.2siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationDesigo CC V5.0siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationDesigo CC V5.1siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationE-Car OC Cloud Applicationsiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationEnergy Engagesiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationEnergyIPsiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationEnlighted Amazesiemens_psirt
For Comfy and Enlighted, see also chapter Additional Information below
- MitigationEnlighted Wheresiemens_psirt
For Comfy and Enlighted, see also chapter Additional Information below
- MitigationGMA-Managersiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationGeolus Shape Search V10siemens_psirt
Find detailed remediation and mitigation information at: https://support.sw.siemens.com/en-US/knowledge-base/PL8601468
- MitigationGeolus Shape Search V11siemens_psirt
Find detailed remediation and mitigation information at: https://support.sw.siemens.com/en-US/knowledge-base/PL8601468
- MitigationHEEDS Connectsiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationHES UDISsiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationIndustrial Edge Hubsiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationIndustrial Edge Management App (IEM-App)siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationIndustrial Edge Management OS (IEM-OS)siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationMendix Applicationssiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationMindSphere App Management Cockpits (Developer& Operator)siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationMindSphere Asset Managersiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationMindSphere IAM (User Management/ Settings)siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationMindSphere Integrated Data Lakesiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationMindSphere Notification Servicesiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationMindSphere Predictive Learningsiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationMindSphere Usage Transparency Servicesiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationMindSphere Visual Explorersiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationMindsphere Cloud Foundrysiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationMindsphere Cloud Platformsiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationNX 1953 Seriessiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationNX 1980 Seriessiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationNX 2007 Seriessiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationNXpower Monitorsiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationOpcenter EX CP Process Automation Controlsiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationOpcenter Execution Core Process Automation Controlsiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationOpcenter Intelligencesiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationOperation Schedulersiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationSENTRON powermanager V4siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationSIGUARD DSAsiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationSIMATIC IPC1047siemens_psirt
Disable ports 8080/tcp and 8443/tcp in the firewall configuration of the IPC
- MitigationSIMATIC IPC1047Esiemens_psirt
Disable ports 8080/tcp and 8443/tcp in the firewall configuration of the IPC
- MitigationSIMATIC IPC647Dsiemens_psirt
Disable ports 8080/tcp and 8443/tcp in the firewall configuration of the IPC
- MitigationSIMATIC IPC647Esiemens_psirt
Disable ports 8080/tcp and 8443/tcp in the firewall configuration of the IPC
- MitigationSIMATIC IPC847Dsiemens_psirt
Disable ports 8080/tcp and 8443/tcp in the firewall configuration of the IPC
- MitigationSIMATIC IPC847Esiemens_psirt
Disable ports 8080/tcp and 8443/tcp in the firewall configuration of the IPC
- MitigationSiPass integrated V2.80siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationSiPass integrated V2.85siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationSimcenter 3Dsiemens_psirt
Find detailed remediation and mitigation information at: https://support.sw.siemens.com/en-US/knowledge-base/PL8601203
- MitigationSimcenter Amesimsiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationSimcenter System Architectsiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationSimcenter System Simulation Client for Gitsiemens_psirt
Find detailed mitigation steps for both server and client installations at: https://support.sw.siemens.com/en-US/knowledge- base/PL8602538
- MitigationSimcenter Testlabsiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationSimcenter Testlab Data Managementsiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationSiveillance Commandsiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationSiveillance Control Pro V2.1siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationSiveillance Control Pro V2.2siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationSiveillance Control Pro V2.3siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationSiveillance Identity V1.5siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationSiveillance Identity V1.6siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationSiveillance Vantagesiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationSolid Edge CAM Prosiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationSolid Edge Wiring and Harness Designsiemens_psirt
Find detailed mitigation steps at: https://support.sw.siemens.com/en- US/knowledge-base/MG618363
- MitigationSpectrum Power 4siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationSpectrum Power 7siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter Active Workspace V4.3siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter Active Workspace V5.0siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter Active Workspace V5.1siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter Active Workspace V5.2siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter Deployment Center V4.0siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter Deployment Center V4.1siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter Deployment Center V4.2siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter EDA V5.1siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter EDA V5.2siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter Integration Framework V13.0siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter Integration Framework V13.1siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter Integration Framework V13.2siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter Integration Framework V3.3siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter Integration Framework V4.0siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter Integration for CATIAsiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter MBSE Gateway V4.1siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter MBSE Gateway V4.2siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter MBSE Gateway V4.3siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter MBSE Gateway V5.0siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter MBSE Gateway V5.1siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter MBSE Gateway V5.2siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter Microservices Framework V5.1siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter Microservices Framework V5.2siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter Reporting and Analytics V11siemens_psirt
Find detailed remediation and mitigation information at: https://support.sw.siemens.com/en-US/knowledge-base/PL8600700
- MitigationTeamcenter Reporting and Analytics V12.2siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter Reporting and Analytics V12.3siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter Reporting and Analytics V12.4siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter Reporting and Analytics V13siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter Technical Publishingsiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter V12.1siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter V12.2siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter V12.3siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter V12.4siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter V13.0siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter V13.1siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter V13.2siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTeamcenter V13.3siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTecnomatix Intositesiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTecnomatix Plant Simulationsiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTecnomatix Process Designersiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTecnomatix Process Simulatesiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTecnomatix Process Simulate VCLitesiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTecnomatix RobotExpertsiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationTecnomatix eBOP Manager Serversiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationValor Parts Library - VPL Directsiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationValor Parts Library - VPL Server or Servicesiemens_psirt
Find detailed remediation and mitigation information at: https://support.sw.siemens.com/knowledge-base/MG618362
- MitigationVeSys V2019.1siemens_psirt
Find detailed mitigation steps at: https://support.sw.siemens.com/en- US/knowledge-base/MG618363
- MitigationVeSys V2020.1siemens_psirt
Find detailed mitigation steps at: https://support.sw.siemens.com/en- US/knowledge-base/MG618363
- MitigationVeSys V2021.1siemens_psirt
Find detailed mitigation steps at: https://support.sw.siemens.com/en- US/knowledge-base/MG618363
- MitigationXpedition Enterprise (XCR) VX.2.10siemens_psirt
Additional information is available at https://support.sw.siemens.com/en-US/product/1644094854/knowledge- base/MG618343
- MitigationXpedition Enterprise VX.2.10siemens_psirt
Additional information is available at https://support.sw.siemens.com/en-US/product/1644094854/knowledge- base/MG618343
- MitigationXpedition Enterprise VX.2.6siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationXpedition Enterprise VX.2.7siemens_psirt
Additional information is available at https://support.sw.siemens.com/en-US/product/1644094854/knowledge- base/MG618343
- MitigationXpedition Enterprise VX.2.8siemens_psirt
Additional information is available at https://support.sw.siemens.com/en-US/product/1644094854/knowledge- base/MG618343
- MitigationXpedition IC Packaging (XCR) VX.2.10siemens_psirt
Additional information is available at https://support.sw.siemens.com/en-US/product/1644094854/knowledge- base/MG618343
- MitigationXpedition IC Packaging VX.2.10siemens_psirt
Additional information is available at https://support.sw.siemens.com/en-US/product/1644094854/knowledge- base/MG618343
- MitigationXpedition IC Packaging VX.2.6siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationXpedition IC Packaging VX.2.7siemens_psirt
Additional information is available at https://support.sw.siemens.com/en-US/product/1644094854/knowledge- base/MG618343
- MitigationXpedition IC Packaging VX.2.8siemens_psirt
Additional information is available at https://support.sw.siemens.com/en-US/product/1644094854/knowledge- base/MG618343
- MitigationcRSPsiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationcRSP Operator Client Startersiemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationjROS for Spectrum Power 4siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationjROS for Spectrum Power 7siemens_psirt
If, for a particular product listed in the table above, no remediation or specific mitigation is given: Block both incoming and outgoing connections between the system and the Internet.
- MitigationSPPA-T3000 SeS3000 Security Server (6DU7054-0..00-..A0)siemens_psirt
Ensure that SPPA-T3000 is set up according to the security concept defined in the SPPA-T3000 security manual
- MitigationFirmware 4.2<4.8.1.4 installed on WAGO Smart Scriptwago_psirt
Do not use projects from untrusted sources. For further impact information and risk mitigation, see the recommendations of the Apache Foundation https://logging.apache.org/log4j/2.x/security.html Bundesamt für Sicherheit in der Informationstechnik (BSI) https://www.bsi.bund.de/DE/Service-Navi/Presse/Pressemitteilungen/Presse2021/211211_log4Shell_WarnstufeRot.html
- No fix availableTraceAlertServerPLUSsiemens_psirt
Currently no remediation is available
- No fix availableSPPA-T3000 SeS3000 Security Server (6DU7054-0..00-..A0)siemens_psirt
Currently no remediation is available
- No fix plannedVeSys V2019.1siemens_psirt
Currently no fix is planned
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–critical · 5.1–9
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
ATT&CK techniques
ATT&CK techniques this enables or maps to.
exploits (12)
Public proof-of-concept and weaponised exploit code.
- auxiliary/scanner/http/log4shell_scannerLog4Shell HTTP Scannerfunctional · metasploit
- BobTheShoplifter/CVE-2021-45046-InfoOh no another onePoC · poc_in_github
affected products (269)
Products and version ranges known to be affected.
- Oracle Fusion Middleware 12.1.3.0.0all versionscert_bundDEcpe:/a:oracle:fusion_middleware:12.1.3.0.0
- Oracle Fusion Middleware 12.2.1.4.0all versionscert_bundDEcpe:/a:oracle:fusion_middleware:12.2.1.4.0
- Oracle Fusion Middleware 14.1.1.0.0all versionscert_bundDEcpe:/a:oracle:fusion_middleware:14.1.1.0.0
- Oracle Fusion Middleware 14.1.2.0.0all versionscert_bundDEcpe:/a:oracle:fusion_middleware:14.1.2.0.0
- Oracle Fusion Middleware 14.1.2.1.0all versionscert_bundDEcpe:/a:oracle:fusion_middleware:14.1.2.1.0
- Oracle Fusion Middleware 15.1.1.0.0all versionscert_bundDEcpe:/a:oracle:fusion_middleware:15.1.1.0.0
advisories (10)
Vendor and ecosystem advisories describing this.
- SSA-397453SSA-397453: Apache Log4j Vulnerabilities (Log4Shell, CVE-2021-44228, CVE-2021-45046) - Impact to Siemens Energy TraceAlertServerPLUS2021-12-20csaf · siemens_psirtDE
On 2021-12-09, a vulnerability in Apache Log4j (a logging library used in many Java-based applications) was disclosed, that could allow remote unauthenticated attackers to execute code on vulnerable systems. The vulnerability is tracked as CVE-2021-44228 and is also known as "Log4Shell". On 2021-12-14 an additional denial of service vulnerability (CVE-2021-45046) was published rendering the initial mitigations and fix in version 2.15.0 as incomplete under certain non-default configurations. Log4j versions 2.16.0 and 2.12.2 are supposed to fix both vulnerabilities. On 2021-12-17, CVE-2021-45046 was reclassified with an increased CVSS base score (from 3.7 to 9.0). The potential impact of CVE-2021-45046 now includes - besides denial of service - also information disclosure and local (and potential remote) code execution. Siemens Energy is preparing updates and recommends specific countermeasures for TraceAlertServerPLUS.
- SSA-479842SSA-479842: Apache Log4j Vulnerabilities - Impact to Siemens Energy Sensformer / Sensgear (Platform, Basic and Advanced)2021-12-21csaf · siemens_psirtDE
On 2021-12-09, a vulnerability in Apache Log4j (a logging tool used in many Java-based applications) was disclosed, that could allow remote unauthenticated attackers to execute code on vulnerable systems. The vulnerability is tracked as CVE-2021-44228 and is also known as "Log4Shell". On 2021-12-14 an additional denial of service vulnerability (CVE-2021-45046) was published rendering the initial mitigations and fix in version 2.15.0 as incomplete under certain non-default configurations. Log4j versions 2.16.0 and 2.12.2 are supposed to fix both vulnerabilities. On 2021-12-17, CVE-2021-45046 was reclassified with an increased CVSS base score (from 3.7 to 9.0). The potential impact of CVE-2021-45046 now includes - besides denial of service - also information disclosure and local (and potential remote) code execution. Furthermore, one additional denial of service vulnerability, CVE-2021-45105, was disclosed. The Siemens Energy Sensformer / Sensgear cloud service was affected by these vulnerabilities and has remediated them. No user actions are necessary.
- SSA-661247SSA-661247: Apache Log4j Vulnerabilities (Log4Shell, CVE-2021-44228, CVE-2021-45046) - Impact to Siemens Products2021-12-13csaf · siemens_psirtDE
On 2021-12-09, a vulnerability in Apache Log4j (a logging tool used in many Java-based applications) was disclosed, that could allow remote unauthenticated attackers to execute code on vulnerable systems. The vulnerability is tracked as CVE-2021-44228 and is also known as "Log4Shell". On 2021-12-14 an additional denial of service vulnerability (CVE-2021-45046) was published rendering the initial mitigations and fix in version 2.15.0 as incomplete under certain non- default configurations. Log4j versions 2.16.0 and 2.12.2 are supposed to fix both vulnerabilities. On 2021-12-17, CVE-2021-45046 was reclassified with an increased CVSS base score (from 3.7 to 9.0). The potential impact of CVE-2021-45046 now includes - besides denial of service - also information disclosure and local (and potential remote) code execution. Siemens is currently investigating to determine which products are affected and is continuously updating this advisory as more information becomes available. See section Additional Information for more details regarding the investigation status. Note: two additional vulnerabilities were published for Apache Log4j, the impact of which are documented in SSA-501673: https://cert- portal.siemens.com/productcert/pdf/ssa-501673.pdf (CVE-2021-45105) and SSA-784507: https://cert- portal.siemens.com/productcert/pdf/ssa-784507.pdf (CVE-2021-44832).
- SSA-714170SSA-714170: Apache Log4j Vulnerabilities (Log4Shell, CVE-2021-44228, CVE-2021-45046) - Impact to SPPA-T30002021-12-16csaf · siemens_psirtDE
On 2021-12-09, a vulnerability in Apache Log4j (a logging library used in many Java-based applications) was disclosed, that could allow remote unauthenticated attackers to execute code on vulnerable systems. The vulnerability is tracked as CVE-2021-44228 and is also known as "Log4Shell". On 2021-12-14 an additional denial of service vulnerability (CVE-2021-45046) was published rendering the initial mitigations and fix in version 2.15.0 as incomplete under certain non-default configurations. Log4j versions 2.16.0 and 2.12.2 are supposed to fix both vulnerabilities. On 2021-12-17, CVE-2021-45046 was reclassified with an increased CVSS base score (from 3.7 to 9.0). The potential impact of CVE-2021-45046 now includes - besides denial of service - also information disclosure and local (and potential remote) code execution. Siemens Energy is preparing updates and recommends specific countermeasures for SPPA-T3000.
- VDE-2021-060WAGO: Smart Script affected by Log4Shell Vulnerability2022-01-05csaf · wago_psirtDE
Apache Log4j is used for logging events in WAGO Smart Script in Version 4.2 and higher. Events logged by Log4j can contain JNDI references. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. Additionally, Log4j does not protect from self-referential lookups, which can lead to Denial of Service. UPDATE A1/2: Affected versions: CVE-2021-44228 and CVE-2021-45046: WAGO Smart Script >= Version 4.2 and < Version 4.8.1.3 CVE-2021-45105: WAGO Smart Script >= Version 4.2 and < Version 4.8.1.4 CVE-2021-44832 WAGO Smart Script >= Version 4.2 and < Version 4.8.1.5 END UPDATE A1/2
- WID-SEC-W-2022-0352Apache log4j: Schwachstelle ermöglicht CodeausführungDeutsch2021-12-14csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Apache log4j ausnutzen, um beliebigen Code auszuführen.
- WID-SEC-W-2023-0063Juniper Junos Space: Mehrere SchwachstellenDeutsch2022-01-12csaf · cert_bundDE
Ein Angreifer aus dem angrenzenden Netzwerk oder ein entfernter anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in Juniper Junos Space ausnutzen, um Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand auszulösen, beliebigen Code auszuführen und seine Privilegien zu erweitern.
- WID-SEC-W-2026-1203Oracle Fusion Middleware: Mehrere SchwachstellenDeutsch2026-04-21csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Fusion Middleware ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- cisco-sa-apache-log4j-qRuKNEbdVulnerabilities in Apache Log4j Library Affecting Cisco Products: December 20212021-12-10csaf · cisco_csafUS
Critical Vulnerabilities in Apache Log4j Java Logging Library On December 9, 2021, the following critical vulnerability in the Apache Log4j Java logging library affecting all Log4j2 versions earlier than 2.15.0 was disclosed: CVE-2021-44228: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints On December 14, 2021, the following critical vulnerability, which affects certain Apache Log4j use cases in versions 2.15.0 and earlier, was disclosed: CVE-2021-45046: Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack On December 18, 2021, a vulnerability in the Apache Log4j component affecting versions 2.16 and earlier was disclosed: CVE-2021-45105: Apache Log4j2 does not always protect from infinite recursion in lookup evaluation On December 28, 2021, a vulnerability in the Apache Log4j component affecting versions 2.17 and earlier was disclosed: CVE-2021-44832: Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration For a description of these vulnerabilities, see the Apache Log4j Security Vulnerabilities ["https://logging.apache.org/log4j/2.x/security.html"] page. Cisco's Response to These Vulnerabilities Cisco assessed all products and services for impact from both CVE-2021-44228 and CVE-2021-45046. To help detect exploitation of these vulnerabilities, Cisco has released Snort rules at the following location: Talos Rules 2021-12-21 ["https://www.snort.org/advisories/talos-rules-2021-12-21"] Product fixes that are listed in this advisory will address both CVE-2021-44228 and CVE-2021-45046 unless otherwise noted. Cisco has reviewed CVE-2021-45105 and CVE-2021-44832 and has determined that no Cisco products or cloud offerings are impacted by these vulnerabilities. Cisco's standard practice is to update integrated third-party software components to later versions as they become available.
- GHSA-7rjr-3q55-vv33Incomplete fix for Apache Log4j vulnerability2021-12-14ghsa · osvUS
# Impact The fix to address [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allow attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in a remote code execution (RCE) attack. ## Affected packages Only the `org.apache.logging.log4j:log4j-core` package is directly affected by this vulnerability. The `org.apache.logging.log4j:log4j-api` should be kept at the same version as the `org.apache.logging.log4j:log4j-core` package to ensure compatability if in use. # Mitigation Log4j 2.16.0 fixes this issue by removing support for message lookup patterns and disabling JNDI functionality by default. This issue can be mitigated in prior releases (< 2.16.0) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). Log4j 2.15.0 restricts JNDI LDAP lookups to localhost by default. Note that previous mitigations involving configuration such as to set the system property `log4j2.formatMsgNoLookups` to `true` do NOT mitigate this specific vulnerability.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (128)
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2021/12/14/4cnnvd
- http://www.openwall.com/lists/oss-security/2021/12/15/3cnnvd
- http://www.openwall.com/lists/oss-security/2021/12/18/1cnnvd
- https://access.redhat.com/security/cve/cve-2021-45046cnnvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdfcnnvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdfcnnvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdfcnnvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdfcnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan