Vulnerabilites related to Siemens - SIMATIC Process Historian 2020
cve-2021-27395
Vulnerability from cvelistv5
Published
2021-10-12 09:49
Modified
2024-08-03 20:48
Severity ?
EPSS score ?
Summary
A vulnerability has been identified in SIMATIC Process Historian 2013 and earlier (All versions), SIMATIC Process Historian 2014 (All versions < SP3 Update 6), SIMATIC Process Historian 2019 (All versions), SIMATIC Process Historian 2020 (All versions). An interface in the software that is used for critical functionalities lacks authentication, which could allow a malicious user to maliciously insert, modify or delete data.
References
| ▼ | URL | Tags |
|---|---|---|
| https://cert-portal.siemens.com/productcert/pdf/ssa-766247.pdf | x_refsource_MISC |
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | Siemens | SIMATIC Process Historian 2013 and earlier |
Version: All versions |
||||||||||||||||
|
|||||||||||||||||||
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-03T20:48:16.821Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://cert-portal.siemens.com/productcert/pdf/ssa-766247.pdf", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "SIMATIC Process Historian 2013 and earlier", vendor: "Siemens", versions: [ { status: "affected", version: "All versions", }, ], }, { product: "SIMATIC Process Historian 2014", vendor: "Siemens", versions: [ { status: "affected", version: "All versions < SP3 Update 6", }, ], }, { product: "SIMATIC Process Historian 2019", vendor: "Siemens", versions: [ { status: "affected", version: "All versions", }, ], }, { product: "SIMATIC Process Historian 2020", vendor: "Siemens", versions: [ { status: "affected", version: "All versions", }, ], }, ], descriptions: [ { lang: "en", value: "A vulnerability has been identified in SIMATIC Process Historian 2013 and earlier (All versions), SIMATIC Process Historian 2014 (All versions < SP3 Update 6), SIMATIC Process Historian 2019 (All versions), SIMATIC Process Historian 2020 (All versions). An interface in the software that is used for critical functionalities lacks authentication, which could allow a malicious user to maliciously insert, modify or delete data.", }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-306", description: "CWE-306: Missing Authentication for Critical Function", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2022-01-11T11:27:05", orgId: "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", shortName: "siemens", }, references: [ { tags: [ "x_refsource_MISC", ], url: "https://cert-portal.siemens.com/productcert/pdf/ssa-766247.pdf", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "productcert@siemens.com", ID: "CVE-2021-27395", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "SIMATIC Process Historian 2013 and earlier", version: { version_data: [ { version_value: "All versions", }, ], }, }, { product_name: "SIMATIC Process Historian 2014", version: { version_data: [ { version_value: "All versions < SP3 Update 6", }, ], }, }, { product_name: "SIMATIC Process Historian 2019", version: { version_data: [ { version_value: "All versions", }, ], }, }, { product_name: "SIMATIC Process Historian 2020", version: { version_data: [ { version_value: "All versions", }, ], }, }, ], }, vendor_name: "Siemens", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "A vulnerability has been identified in SIMATIC Process Historian 2013 and earlier (All versions), SIMATIC Process Historian 2014 (All versions < SP3 Update 6), SIMATIC Process Historian 2019 (All versions), SIMATIC Process Historian 2020 (All versions). An interface in the software that is used for critical functionalities lacks authentication, which could allow a malicious user to maliciously insert, modify or delete data.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "CWE-306: Missing Authentication for Critical Function", }, ], }, ], }, references: { reference_data: [ { name: "https://cert-portal.siemens.com/productcert/pdf/ssa-766247.pdf", refsource: "MISC", url: "https://cert-portal.siemens.com/productcert/pdf/ssa-766247.pdf", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", assignerShortName: "siemens", cveId: "CVE-2021-27395", datePublished: "2021-10-12T09:49:20", dateReserved: "2021-02-18T00:00:00", dateUpdated: "2024-08-03T20:48:16.821Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-35783
Vulnerability from cvelistv5
Published
2024-09-10 09:36
Modified
2025-01-14 10:30
Severity ?
9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C
9.4 (Critical) - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
9.4 (Critical) - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS score ?
Summary
A vulnerability has been identified in SIMATIC BATCH V9.1 (All versions), SIMATIC Information Server 2020 (All versions < V2020 SP2 Update 5), SIMATIC Information Server 2022 (All versions < V2022 SP1 Update 2), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP2 UC06), SIMATIC Process Historian 2020 (All versions < V2020 SP2 Update 5), SIMATIC Process Historian 2022 (All versions < V2022 SP1 Update 2), SIMATIC WinCC Runtime Professional V18 (All versions < V18 Update 5), SIMATIC WinCC Runtime Professional V19 (All versions < V19 Update 3), SIMATIC WinCC V7.4 (All versions), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 18), SIMATIC WinCC V8.0 (All versions < V8.0 Update 5). The affected products run their DB server with elevated privileges which could allow an authenticated attacker to execute arbitrary OS commands with administrative privileges.
References
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | Siemens | SIMATIC BATCH V9.1 |
Version: 0 < * |
|||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
{ containers: { adp: [ { affected: [ { cpes: [ "cpe:2.3:a:siemens:simatic_wincc_runtime_professional:18:*:*:*:*:*:*:*", "cpe:2.3:a:siemens:simatic_wincc_runtime_professional:19:*:*:*:*:*:*:*", "cpe:2.3:h:siemens:simatic_process_historian:2020:-:*:*:*:*:*:*", "cpe:2.3:a:siemens:simatic_process_historian:2022:*:*:*:*:*:*:*", "cpe:2.3:a:siemens:simatic_pcs7:*:*:*:*:*:*:*:*", "cpe:2.3:a:siemens:simatic_information_server:2020:-:*:*:*:*:*:*", "cpe:2.3:a:siemens:simatic_information_server:2022:*:*:*:*:*:*:*", "cpe:2.3:a:siemens:simatic_batch:9.1:-:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "simatic_batch", vendor: "siemens", versions: [ { lessThan: "*", status: "affected", version: "0", versionType: "custom", }, ], }, { cpes: [ "cpe:2.3:a:siemens:simatic_wincc:*:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "simatic_wincc", vendor: "siemens", versions: [ { lessThan: "7.5_sp2_update_18", status: "affected", version: "7.4", versionType: "custom", }, { lessThan: "8.0_update_5", status: "affected", version: "8.0", versionType: "custom", }, ], }, ], metrics: [ { other: { content: { id: "CVE-2024-35783", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-09-10T15:12:46.700884Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-09-10T17:31:08.389Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "unknown", product: "SIMATIC BATCH V9.1", vendor: "Siemens", versions: [ { lessThan: "*", status: "affected", version: "0", versionType: "custom", }, ], }, { defaultStatus: "unknown", product: "SIMATIC Information Server 2020", vendor: "Siemens", versions: [ { lessThan: "V2020 SP2 Update 5", status: "affected", version: "0", versionType: "custom", }, ], }, { defaultStatus: "unknown", product: "SIMATIC Information Server 2022", vendor: "Siemens", versions: [ { lessThan: "V2022 SP1 Update 2", status: "affected", version: "0", versionType: "custom", }, ], }, { defaultStatus: "unknown", product: "SIMATIC PCS 7 V9.1", vendor: "Siemens", versions: [ { lessThan: "V9.1 SP2 UC06", status: "affected", version: "0", versionType: "custom", }, ], }, { defaultStatus: "unknown", product: "SIMATIC Process Historian 2020", vendor: "Siemens", versions: [ { lessThan: "V2020 SP2 Update 5", status: "affected", version: "0", versionType: "custom", }, ], }, { defaultStatus: "unknown", product: "SIMATIC Process Historian 2022", vendor: "Siemens", versions: [ { lessThan: "V2022 SP1 Update 2", status: "affected", version: "0", versionType: "custom", }, ], }, { defaultStatus: "unknown", product: "SIMATIC WinCC Runtime Professional V18", vendor: "Siemens", versions: [ { lessThan: "V18 Update 5", status: "affected", version: "0", versionType: "custom", }, ], }, { defaultStatus: "unknown", product: "SIMATIC WinCC Runtime Professional V19", vendor: "Siemens", versions: [ { lessThan: "V19 Update 3", status: "affected", version: "0", versionType: "custom", }, ], }, { defaultStatus: "unknown", product: "SIMATIC WinCC V7.4", vendor: "Siemens", versions: [ { lessThan: "*", status: "affected", version: "0", versionType: "custom", }, ], }, { defaultStatus: "unknown", product: "SIMATIC WinCC V7.5", vendor: "Siemens", versions: [ { lessThan: "V7.5 SP2 Update 18", status: "affected", version: "0", versionType: "custom", }, ], }, { defaultStatus: "unknown", product: "SIMATIC WinCC V8.0", vendor: "Siemens", versions: [ { lessThan: "V8.0 Update 5", status: "affected", version: "0", versionType: "custom", }, ], }, ], descriptions: [ { lang: "en", value: "A vulnerability has been identified in SIMATIC BATCH V9.1 (All versions), SIMATIC Information Server 2020 (All versions < V2020 SP2 Update 5), SIMATIC Information Server 2022 (All versions < V2022 SP1 Update 2), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP2 UC06), SIMATIC Process Historian 2020 (All versions < V2020 SP2 Update 5), SIMATIC Process Historian 2022 (All versions < V2022 SP1 Update 2), SIMATIC WinCC Runtime Professional V18 (All versions < V18 Update 5), SIMATIC WinCC Runtime Professional V19 (All versions < V19 Update 3), SIMATIC WinCC V7.4 (All versions), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 18), SIMATIC WinCC V8.0 (All versions < V8.0 Update 5). The affected products run their DB server with elevated privileges which could allow an authenticated attacker to execute arbitrary OS commands with administrative privileges.", }, ], metrics: [ { cvssV3_1: { baseScore: 9.1, baseSeverity: "CRITICAL", vectorString: "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C", version: "3.1", }, }, { cvssV4_0: { baseScore: 9.4, baseSeverity: "CRITICAL", vectorString: "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", version: "4.0", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-250", description: "CWE-250: Execution with Unnecessary Privileges", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2025-01-14T10:30:01.253Z", orgId: "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", shortName: "siemens", }, references: [ { url: "https://cert-portal.siemens.com/productcert/html/ssa-629254.html", }, ], }, }, cveMetadata: { assignerOrgId: "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", assignerShortName: "siemens", cveId: "CVE-2024-35783", datePublished: "2024-09-10T09:36:32.225Z", dateReserved: "2024-05-17T11:07:53.264Z", dateUpdated: "2025-01-14T10:30:01.253Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
var-202110-0133
Vulnerability from variot
A vulnerability has been identified in SIMATIC Process Historian 2013 and earlier (All versions), SIMATIC Process Historian 2014 (All versions < SP3 Update 6), SIMATIC Process Historian 2019 (All versions), SIMATIC Process Historian 2020 (All versions). An interface in the software that is used for critical functionalities lacks authentication, which could allow a malicious user to maliciously insert, modify or delete data. Multiple Siemens products are vulnerable to missing authentication for critical functionality.Information is tampered with and service operation is interrupted (DoS) It may be in a state. Siemens Simatic Process Historian is a central filing system of Siemens (Siemens) in Germany
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", affected_products: { "@id": "https://www.variotdbs.pl/ref/affected_products", }, configurations: { "@id": "https://www.variotdbs.pl/ref/configurations", }, credits: { "@id": "https://www.variotdbs.pl/ref/credits", }, cvss: { "@id": "https://www.variotdbs.pl/ref/cvss/", }, description: { "@id": "https://www.variotdbs.pl/ref/description/", }, exploit_availability: { "@id": "https://www.variotdbs.pl/ref/exploit_availability/", }, external_ids: { "@id": "https://www.variotdbs.pl/ref/external_ids/", }, iot: { "@id": "https://www.variotdbs.pl/ref/iot/", }, iot_taxonomy: { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/", }, patch: { "@id": "https://www.variotdbs.pl/ref/patch/", }, problemtype_data: { "@id": "https://www.variotdbs.pl/ref/problemtype_data/", }, references: { "@id": "https://www.variotdbs.pl/ref/references/", }, sources: { "@id": "https://www.variotdbs.pl/ref/sources/", }, sources_release_date: { "@id": "https://www.variotdbs.pl/ref/sources_release_date/", }, sources_update_date: { "@id": "https://www.variotdbs.pl/ref/sources_update_date/", }, threat_type: { "@id": "https://www.variotdbs.pl/ref/threat_type/", }, title: { "@id": "https://www.variotdbs.pl/ref/title/", }, type: { "@id": "https://www.variotdbs.pl/ref/type/", }, }, "@id": "https://www.variotdbs.pl/vuln/VAR-202110-0133", affected_products: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, "@id": "https://www.variotdbs.pl/ref/sources", }, }, data: [ { model: "simatic process historian 2013", scope: "eq", trust: 1, vendor: "siemens", version: "*", }, { model: "simatic process historian 2019", scope: "eq", trust: 1, vendor: "siemens", version: "*", }, { model: "simatic process historian 2014", scope: "eq", trust: 1, vendor: "siemens", version: null, }, { model: "simatic process historian 2020", scope: "eq", trust: 1, vendor: "siemens", version: "*", }, { model: "simatic process historian 2020", scope: null, trust: 0.8, vendor: "シーメンス", version: null, }, { model: "simatic process historian 2019", scope: null, trust: 0.8, vendor: "シーメンス", version: null, }, { model: "simatic process historian 2014", scope: null, trust: 0.8, vendor: "シーメンス", version: null, }, { model: "simatic process historian 2013", scope: null, trust: 0.8, vendor: "シーメンス", version: null, }, { model: "simatic process historian and earlier", scope: "eq", trust: 0.6, vendor: "siemens", version: "2013", }, { model: "simatic process historian sp3 update", scope: "eq", trust: 0.6, vendor: "siemens", version: "2014<6", }, { model: "simatic process historian", scope: "eq", trust: 0.6, vendor: "siemens", version: "2019", }, { model: "simatic process historian", scope: "eq", trust: 0.6, vendor: "siemens", version: "2020", }, ], sources: [ { db: "CNVD", id: "CNVD-2021-77609", }, { db: "JVNDB", id: "JVNDB-2021-013657", }, { db: "NVD", id: "CVE-2021-27395", }, ], }, configurations: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", children: { "@container": "@list", }, cpe_match: { "@container": "@list", }, data: { "@container": "@list", }, nodes: { "@container": "@list", }, }, data: [ { CVE_data_version: "4.0", nodes: [ { children: [], cpe_match: [ { cpe23Uri: "cpe:2.3:a:siemens:simatic_process_historian_2013:*:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:siemens:simatic_process_historian_2014:-:sp1:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:siemens:simatic_process_historian_2014:-:sp2:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:siemens:simatic_process_historian_2014:-:sp3:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:siemens:simatic_process_historian_2014:-:sp3_update4:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:siemens:simatic_process_historian_2019:*:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:siemens:simatic_process_historian_2020:*:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, ], operator: "OR", }, ], }, ], sources: [ { db: "NVD", id: "CVE-2021-27395", }, ], }, cve: "CVE-2021-27395", cvss: { "@context": { cvssV2: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#", }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2", }, cvssV3: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#", }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/", }, severity: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#", }, "@id": "https://www.variotdbs.pl/ref/cvss/severity", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, "@id": "https://www.variotdbs.pl/ref/sources", }, }, data: [ { cvssV2: [ { acInsufInfo: false, accessComplexity: "LOW", accessVector: "NETWORK", authentication: "SINGLE", author: "NVD", availabilityImpact: "PARTIAL", baseScore: 5.5, confidentialityImpact: "NONE", exploitabilityScore: 8, impactScore: 4.9, integrityImpact: "PARTIAL", obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, severity: "MEDIUM", trust: 1, userInteractionRequired: false, vectorString: "AV:N/AC:L/Au:S/C:N/I:P/A:P", version: "2.0", }, { acInsufInfo: null, accessComplexity: "Low", accessVector: "Network", authentication: "Single", author: "NVD", availabilityImpact: "Partial", baseScore: 5.5, confidentialityImpact: "None", exploitabilityScore: null, id: "CVE-2021-27395", impactScore: null, integrityImpact: "Partial", obtainAllPrivilege: null, obtainOtherPrivilege: null, obtainUserPrivilege: null, severity: "Medium", trust: 0.9, userInteractionRequired: null, vectorString: "AV:N/AC:L/Au:S/C:N/I:P/A:P", version: "2.0", }, { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "NONE", author: "CNVD", availabilityImpact: "NONE", baseScore: 4.3, confidentialityImpact: "NONE", exploitabilityScore: 8.6, id: "CNVD-2021-77609", impactScore: 2.9, integrityImpact: "PARTIAL", severity: "MEDIUM", trust: 0.6, vectorString: "AV:N/AC:M/Au:N/C:N/I:P/A:N", version: "2.0", }, ], cvssV3: [ { attackComplexity: "LOW", attackVector: "NETWORK", author: "NVD", availabilityImpact: "HIGH", baseScore: 8.1, baseSeverity: "HIGH", confidentialityImpact: "NONE", exploitabilityScore: 2.8, impactScore: 5.2, integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", trust: 1, userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", version: "3.1", }, { attackComplexity: "Low", attackVector: "Network", author: "NVD", availabilityImpact: "High", baseScore: 8.1, baseSeverity: "High", confidentialityImpact: "None", exploitabilityScore: null, id: "CVE-2021-27395", impactScore: null, integrityImpact: "High", privilegesRequired: "Low", scope: "Unchanged", trust: 0.8, userInteraction: "None", vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", version: "3.0", }, ], severity: [ { author: "NVD", id: "CVE-2021-27395", trust: 1.8, value: "HIGH", }, { author: "CNVD", id: "CNVD-2021-77609", trust: 0.6, value: "MEDIUM", }, { author: "CNNVD", id: "CNNVD-202110-774", trust: 0.6, value: "HIGH", }, { author: "VULMON", id: "CVE-2021-27395", trust: 0.1, value: "MEDIUM", }, ], }, ], sources: [ { db: "CNVD", id: "CNVD-2021-77609", }, { db: "VULMON", id: "CVE-2021-27395", }, { db: "JVNDB", id: "JVNDB-2021-013657", }, { db: "NVD", id: "CVE-2021-27395", }, { db: "CNNVD", id: "CNNVD-202110-774", }, ], }, description: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "A vulnerability has been identified in SIMATIC Process Historian 2013 and earlier (All versions), SIMATIC Process Historian 2014 (All versions < SP3 Update 6), SIMATIC Process Historian 2019 (All versions), SIMATIC Process Historian 2020 (All versions). An interface in the software that is used for critical functionalities lacks authentication, which could allow a malicious user to maliciously insert, modify or delete data. Multiple Siemens products are vulnerable to missing authentication for critical functionality.Information is tampered with and service operation is interrupted (DoS) It may be in a state. Siemens Simatic Process Historian is a central filing system of Siemens (Siemens) in Germany", sources: [ { db: "NVD", id: "CVE-2021-27395", }, { db: "JVNDB", id: "JVNDB-2021-013657", }, { db: "CNVD", id: "CNVD-2021-77609", }, { db: "VULMON", id: "CVE-2021-27395", }, ], trust: 2.25, }, external_ids: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { db: "NVD", id: "CVE-2021-27395", trust: 3.9, }, { db: "SIEMENS", id: "SSA-766247", trust: 2.3, }, { db: "ICS CERT", id: "ICSA-21-287-09", trust: 0.8, }, { db: "JVN", id: "JVNVU95938083", trust: 0.8, }, { db: "JVNDB", id: "JVNDB-2021-013657", trust: 0.8, }, { db: "CNVD", id: "CNVD-2021-77609", trust: 0.6, }, { db: "CS-HELP", id: "SB2021101315", trust: 0.6, }, { db: "AUSCERT", id: "ESB-2021.3457", trust: 0.6, }, { db: "CNNVD", id: "CNNVD-202110-774", trust: 0.6, }, { db: "VULMON", id: "CVE-2021-27395", trust: 0.1, }, ], sources: [ { db: "CNVD", id: "CNVD-2021-77609", }, { db: "VULMON", id: "CVE-2021-27395", }, { db: "JVNDB", id: "JVNDB-2021-013657", }, { db: "NVD", id: "CVE-2021-27395", }, { db: "CNNVD", id: "CNNVD-202110-774", }, ], }, id: "VAR-202110-0133", iot: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: true, sources: [ { db: "CNVD", id: "CNVD-2021-77609", }, ], trust: 1.201190465, }, iot_taxonomy: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { category: [ "ICS", ], sub_category: null, trust: 0.6, }, ], sources: [ { db: "CNVD", id: "CNVD-2021-77609", }, ], }, last_update_date: "2023-12-18T11:26:58.982000Z", patch: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { title: "SSA-766247", trust: 0.8, url: "https://cert-portal.siemens.com/productcert/pdf/ssa-766247.pdf", }, { title: "Patch for Siemens SIMATIC Process Historian Authentication Vulnerability", trust: 0.6, url: "https://www.cnvd.org.cn/patchinfo/show/294041", }, { title: "Siemens Simatic Process Historian Fixes for access control error vulnerabilities", trust: 0.6, url: "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=166925", }, { title: "Siemens Security Advisories: Siemens Security Advisory", trust: 0.1, url: "https://vulmon.com/vendoradvisory?qidtp=siemens_security_advisories&qid=e0fc46fc4fdb2069205e9c33ccc0cf23", }, ], sources: [ { db: "CNVD", id: "CNVD-2021-77609", }, { db: "VULMON", id: "CVE-2021-27395", }, { db: "JVNDB", id: "JVNDB-2021-013657", }, { db: "CNNVD", id: "CNNVD-202110-774", }, ], }, problemtype_data: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { problemtype: "CWE-306", trust: 1, }, { problemtype: "Lack of authentication for critical features (CWE-306) [NVD evaluation ]", trust: 0.8, }, ], sources: [ { db: "JVNDB", id: "JVNDB-2021-013657", }, { db: "NVD", id: "CVE-2021-27395", }, ], }, references: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { trust: 2.3, url: "https://cert-portal.siemens.com/productcert/pdf/ssa-766247.pdf", }, { trust: 1.4, url: "https://nvd.nist.gov/vuln/detail/cve-2021-27395", }, { trust: 0.8, url: "http://jvn.jp/vu/jvnvu95938083/index.html", }, { trust: 0.8, url: "https://www.cisa.gov/uscert/ics/advisories/icsa-21-287-09", }, { trust: 0.6, url: "https://www.cybersecurity-help.cz/vdb/sb2021101315", }, { trust: 0.6, url: "https://www.auscert.org.au/bulletins/esb-2021.3457", }, { trust: 0.6, url: "https://vigilance.fr/vulnerability/simatic-process-historian-read-write-access-via-authentication-bypass-36636", }, { trust: 0.1, url: "https://cwe.mitre.org/data/definitions/306.html", }, { trust: 0.1, url: "https://nvd.nist.gov", }, { trust: 0.1, url: "https://cert-portal.siemens.com/productcert/txt/ssa-766247.txt", }, ], sources: [ { db: "CNVD", id: "CNVD-2021-77609", }, { db: "VULMON", id: "CVE-2021-27395", }, { db: "JVNDB", id: "JVNDB-2021-013657", }, { db: "NVD", id: "CVE-2021-27395", }, { db: "CNNVD", id: "CNNVD-202110-774", }, ], }, sources: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", data: { "@container": "@list", }, }, data: [ { db: "CNVD", id: "CNVD-2021-77609", }, { db: "VULMON", id: "CVE-2021-27395", }, { db: "JVNDB", id: "JVNDB-2021-013657", }, { db: "NVD", id: "CVE-2021-27395", }, { db: "CNNVD", id: "CNNVD-202110-774", }, ], }, sources_release_date: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", data: { "@container": "@list", }, }, data: [ { date: "2021-10-16T00:00:00", db: "CNVD", id: "CNVD-2021-77609", }, { date: "2021-10-12T00:00:00", db: "VULMON", id: "CVE-2021-27395", }, { date: "2022-09-21T00:00:00", db: "JVNDB", id: "JVNDB-2021-013657", }, { date: "2021-10-12T10:15:11.493000", db: "NVD", id: "CVE-2021-27395", }, { date: "2021-10-12T00:00:00", db: "CNNVD", id: "CNNVD-202110-774", }, ], }, sources_update_date: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", data: { "@container": "@list", }, }, data: [ { date: "2022-01-18T00:00:00", db: "CNVD", id: "CNVD-2021-77609", }, { date: "2021-10-19T00:00:00", db: "VULMON", id: "CVE-2021-27395", }, { date: "2022-09-21T02:55:00", db: "JVNDB", id: "JVNDB-2021-013657", }, { date: "2021-10-19T01:11:52.747000", db: "NVD", id: "CVE-2021-27395", }, { date: "2021-10-22T00:00:00", db: "CNNVD", id: "CNNVD-202110-774", }, ], }, threat_type: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "remote", sources: [ { db: "CNNVD", id: "CNNVD-202110-774", }, ], trust: 0.6, }, title: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "Lack of authentication for critical functions in multiple Siemens products", sources: [ { db: "JVNDB", id: "JVNDB-2021-013657", }, ], trust: 0.8, }, type: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "access control error", sources: [ { db: "CNNVD", id: "CNNVD-202110-774", }, ], trust: 0.6, }, }