Vulnerability-Lookup

CVE-2021-31891 (GCVE-0-2021-31891)

Vulnerability from cvelistv5 – Published: 2021-09-14 10:47 – Updated: 2024-08-03 23:10

Summary

Severity

No CVSS data available.

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

siemens

References

1 reference

URL	Tags
https://cert-portal.siemens.com/productcert/pdf/s…	x_refsource_MISC

Impacted products

5 products

Vendor	Product	Version
Siemens	Desigo CC	Affected: All versions with OIS Extension Module
Siemens	GMA-Manager	Affected: All versions with OIS running on Debian 9 or earlier
Siemens	Operation Scheduler	Affected: All versions with OIS running on Debian 9 or earlier
Siemens	Siveillance Control	Affected: All versions with OIS running on Debian 9 or earlier
Siemens	Siveillance Control Pro	Affected: All versions

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T23:10:30.639Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-535380.pdf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Desigo CC",
          "vendor": "Siemens",
          "versions": [
            {
              "status": "affected",
              "version": "All versions with OIS Extension Module"
            }
          ]
        },
        {
          "product": "GMA-Manager",
          "vendor": "Siemens",
          "versions": [
            {
              "status": "affected",
              "version": "All versions with OIS running on Debian 9 or earlier"
            }
          ]
        },
        {
          "product": "Operation Scheduler",
          "vendor": "Siemens",
          "versions": [
            {
              "status": "affected",
              "version": "All versions with OIS running on Debian 9 or earlier"
            }
          ]
        },
        {
          "product": "Siveillance Control",
          "vendor": "Siemens",
          "versions": [
            {
              "status": "affected",
              "version": "All versions with OIS running on Debian 9 or earlier"
            }
          ]
        },
        {
          "product": "Siveillance Control Pro",
          "vendor": "Siemens",
          "versions": [
            {
              "status": "affected",
              "version": "All versions"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been identified in Desigo CC (All versions with OIS Extension Module), GMA-Manager (All versions with OIS running on Debian 9 or earlier), Operation Scheduler (All versions with OIS running on Debian 9 or earlier), Siveillance Control (All versions with OIS running on Debian 9 or earlier), Siveillance Control Pro (All versions). The affected application incorrectly neutralizes special elements in a specific HTTP GET request which could lead to command injection. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary code on the system with root privileges."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-09-14T10:47:31.000Z",
        "orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
        "shortName": "siemens"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-535380.pdf"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "productcert@siemens.com",
          "ID": "CVE-2021-31891",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Desigo CC",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "All versions with OIS Extension Module"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "GMA-Manager",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "All versions with OIS running on Debian 9 or earlier"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Operation Scheduler",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "All versions with OIS running on Debian 9 or earlier"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Siveillance Control",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "All versions with OIS running on Debian 9 or earlier"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Siveillance Control Pro",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "All versions"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Siemens"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A vulnerability has been identified in Desigo CC (All versions with OIS Extension Module), GMA-Manager (All versions with OIS running on Debian 9 or earlier), Operation Scheduler (All versions with OIS running on Debian 9 or earlier), Siveillance Control (All versions with OIS running on Debian 9 or earlier), Siveillance Control Pro (All versions). The affected application incorrectly neutralizes special elements in a specific HTTP GET request which could lead to command injection. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary code on the system with root privileges."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-535380.pdf",
              "refsource": "MISC",
              "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-535380.pdf"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
    "assignerShortName": "siemens",
    "cveId": "CVE-2021-31891",
    "datePublished": "2021-09-14T10:47:31.000Z",
    "dateReserved": "2021-04-29T00:00:00.000Z",
    "dateUpdated": "2024-08-03T23:10:30.639Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-31891",
      "date": "2026-05-27",
      "epss": "0.04575",
      "percentile": "0.89346"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:desigo_cc:*:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"90D75ECA-E171-42BD-A475-A1DD4B9BE013\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:siveillance_control_pro:*:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6D1D6B61-1F17-4008-9DFB-EF419777768E\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:gma-manager:*:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E2504273-D83D-462E-A8CF-09107517D75D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:operation_scheduler:*:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DFB86317-9626-454A-89D3-2B96FDF84CC3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:siemens:siveillance_control:*:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F5A18694-B44A-424A-8811-0D0E4FD729A8\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:o:debian:debian_linux:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"9.0\", \"matchCriteriaId\": \"B79BD779-60A5-43A8-9229-07C11A3167AA\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"A vulnerability has been identified in Desigo CC (All versions with OIS Extension Module), GMA-Manager (All versions with OIS running on Debian 9 or earlier), Operation Scheduler (All versions with OIS running on Debian 9 or earlier), Siveillance Control (All versions with OIS running on Debian 9 or earlier), Siveillance Control Pro (All versions). The affected application incorrectly neutralizes special elements in a specific HTTP GET request which could lead to command injection. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary code on the system with root privileges.\"}, {\"lang\": \"es\", \"value\": \"Se ha identificado una vulnerabilidad en Desigo CC (Todas las versiones con m\\u00f3dulo de extensi\\u00f3n OIS), GMA-Manager (Todas las versiones con OIS que se ejecutan en Debian 9 o anterior), Operation Scheduler (Todas las versiones con OIS que se ejecutan en Debian 9 o anterior), Siveillance Control (Todas las versiones con OIS que se ejecutan en Debian 9 o anterior), Siveillance Control Pro (Todas las versiones). La aplicaci\\u00f3n afectada neutraliza incorrectamente elementos especiales en una petici\\u00f3n HTTP GET espec\\u00edfica que podr\\u00eda conllevar a una inyecci\\u00f3n de comandos. Un atacante remoto no autenticado podr\\u00eda aprovechar esta vulnerabilidad para ejecutar c\\u00f3digo arbitrario en el sistema con privilegios de root\"}]",
      "id": "CVE-2021-31891",
      "lastModified": "2024-11-21T06:06:26.703",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\", \"baseScore\": 10.0, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 6.0}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:N/C:C/I:C/A:C\", \"baseScore\": 10.0, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"COMPLETE\", \"integrityImpact\": \"COMPLETE\", \"availabilityImpact\": \"COMPLETE\"}, \"baseSeverity\": \"HIGH\", \"exploitabilityScore\": 10.0, \"impactScore\": 10.0, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2021-09-14T11:15:24.023",
      "references": "[{\"url\": \"https://cert-portal.siemens.com/productcert/pdf/ssa-535380.pdf\", \"source\": \"productcert@siemens.com\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"https://cert-portal.siemens.com/productcert/pdf/ssa-535380.pdf\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}]",
      "sourceIdentifier": "productcert@siemens.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"productcert@siemens.com\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-78\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-31891\",\"sourceIdentifier\":\"productcert@siemens.com\",\"published\":\"2021-09-14T11:15:24.023\",\"lastModified\":\"2024-11-21T06:06:26.703\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability has been identified in Desigo CC (All versions with OIS Extension Module), GMA-Manager (All versions with OIS running on Debian 9 or earlier), Operation Scheduler (All versions with OIS running on Debian 9 or earlier), Siveillance Control (All versions with OIS running on Debian 9 or earlier), Siveillance Control Pro (All versions). The affected application incorrectly neutralizes special elements in a specific HTTP GET request which could lead to command injection. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary code on the system with root privileges.\"},{\"lang\":\"es\",\"value\":\"Se ha identificado una vulnerabilidad en Desigo CC (Todas las versiones con m\u00f3dulo de extensi\u00f3n OIS), GMA-Manager (Todas las versiones con OIS que se ejecutan en Debian 9 o anterior), Operation Scheduler (Todas las versiones con OIS que se ejecutan en Debian 9 o anterior), Siveillance Control (Todas las versiones con OIS que se ejecutan en Debian 9 o anterior), Siveillance Control Pro (Todas las versiones). La aplicaci\u00f3n afectada neutraliza incorrectamente elementos especiales en una petici\u00f3n HTTP GET espec\u00edfica que podr\u00eda conllevar a una inyecci\u00f3n de comandos. Un atacante remoto no autenticado podr\u00eda aprovechar esta vulnerabilidad para ejecutar c\u00f3digo arbitrario en el sistema con privilegios de root\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":10.0,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":6.0}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:C/I:C/A:C\",\"baseScore\":10.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":10.0,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"productcert@siemens.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-78\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:desigo_cc:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"90D75ECA-E171-42BD-A475-A1DD4B9BE013\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:siveillance_control_pro:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6D1D6B61-1F17-4008-9DFB-EF419777768E\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:gma-manager:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E2504273-D83D-462E-A8CF-09107517D75D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:operation_scheduler:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DFB86317-9626-454A-89D3-2B96FDF84CC3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:siveillance_control:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F5A18694-B44A-424A-8811-0D0E4FD729A8\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:debian:debian_linux:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"9.0\",\"matchCriteriaId\":\"B79BD779-60A5-43A8-9229-07C11A3167AA\"}]}]}],\"references\":[{\"url\":\"https://cert-portal.siemens.com/productcert/pdf/ssa-535380.pdf\",\"source\":\"productcert@siemens.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/pdf/ssa-535380.pdf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]}]}}"
  }
}

CERTFR-2021-AVI-706

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été découvertes dans les produits Siemens. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Siemens	N/A	SINEMA Server versions antérieures à V14 SP3
Siemens	N/A	SIMATIC CP 1543-1 (incl. SIPLUS variants) versions antérieures à V3.0
Siemens	N/A	SCALANCE X212-2LD versions antérieures à V5.2.5
Siemens	N/A	SCALANCE X202-2 IRT toutes versions
Siemens	N/A	Desigo CC V4.0 toutes versions
Siemens	N/A	TALON TC Modular (BACnet) versions antérieures à V3.5.3
Siemens	N/A	SCALANCE X204-2FM versions antérieures à V5.2.5
Siemens	N/A	SCALANCE X320-1 FE toutes versions
Siemens	N/A	LOGO! CMR2040 versions antérieures à V2.2
Siemens	N/A	SIMATIC RF350M toutes versions
Siemens	N/A	SCALANCE X308-2 (incl. SIPLUS NET variant) toutes versions
Siemens	N/A	Desigo CC Compact V5.0 versions antérieures à V5.0 QU1
Siemens	N/A	SCALANCE XF204 versions antérieures à V5.2.5
Siemens	N/A	SCALANCE XF204-2BA IRT toutes versions
Siemens	N/A	SINEMA Remote Connect Server versions antérieures à V3.0 SP2
Siemens	N/A	Teamcenter Active Workspace V5.1 versions antérieures à V5.1.5
Siemens	N/A	SCALANCE X307-3LD toutes versions
Siemens	N/A	RUGGEDCOM ROX RX1511 versions antérieures à V2.14.1
Siemens	N/A	SCALANCE X204-2 (incl. SIPLUS NET variant) versions antérieures à V5.2.5
Siemens	N/A	SCALANCE XR324-4M EEC toutes versions
Siemens	N/A	SCALANCE X224 versions antérieures à V5.2.5
Siemens	N/A	Desigo CC V5.0 versions antérieures à V5.0 QU1
Siemens	N/A	Teamcenter V13.0 versions antérieures à V13.0.0.7
Siemens	N/A	SCALANCE X204 IRT PRO toutes versions
Siemens	N/A	TALON TC Compact (BACnet) versions antérieures à V3.5.3
Siemens	N/A	Simcenter STAR-CCM+ Viewer versions antérieures à V2021.2.1
Siemens	N/A	Teamcenter Active Workspace V4.3 versions antérieures à V4.3.10
Siemens	N/A	Cerberus DMS V4.0 toutes versions
Siemens	N/A	APOGEE MEC (PPC) (P2 Ethernet) toutes versions >= V2.6.3
Siemens	N/A	SIMATIC CP 443-1 (incl. SIPLUS variants) toutes versions
Siemens	N/A	SCALANCE X310FE toutes versions
Siemens	N/A	SCALANCE X206-1 versions antérieures à V5.2.5
Siemens	N/A	RUGGEDCOM ROX MX5000 versions antérieures à V2.14.1
Siemens	N/A	Desigo CC Compact V4.2 toutes versions
Siemens	N/A	Desigo CC Compact V4.1 toutes versions
Siemens	N/A	RUGGEDCOM ROX RX1500 versions antérieures à V2.14.1
Siemens	N/A	SCALANCE X208 (incl. SIPLUS NET variant) versions antérieures à V5.2.5
Siemens	N/A	SCALANCE X306-1LD FE toutes versions
Siemens	N/A	SIMATIC CP 443-1 Advanced (incl. SIPLUS variants) toutes versions
Siemens	N/A	Siveillance Control Pro toutes versions
Siemens	N/A	RUGGEDCOM ROX RX1501 versions antérieures à V2.14.1
Siemens	N/A	SCALANCE X202-2P IRT (incl. SIPLUS NET variant) toutes versions
Siemens	N/A	SINEC NMS versions antérieures à V1.0 SP1
Siemens	N/A	SIPROTEC 5 relays with CPU variants CP200 toutes versions
Siemens	N/A	SCALANCE X307-2 EEC toutes versions
Siemens	N/A	Cerberus DMS V4.1 toutes versions
Siemens	N/A	SIMATIC RTU 3000 family toutes versions
Siemens	N/A	SCALANCE X202-2P IRT PRO toutes versions
Siemens	N/A	LOGO! CMR2020 versions antérieures à V2.2
Siemens	N/A	Operation Scheduler toutes versions with OIS running on Debian 9 or earlier
Siemens	N/A	SCALANCE X208PRO versions antérieures à V5.2.5
Siemens	N/A	SCALANCE X408-2 toutes versions
Siemens	N/A	SIPROTEC 5 relays with CPU variants CP300 versions antérieures à V8.80
Siemens	N/A	RUGGEDCOM ROX RX1400 versions antérieures à V2.14.1
Siemens	N/A	APOGEE PXC Modular (P2 Ethernet) toutes versions >= V2.8
Siemens	N/A	SIMATIC RF650M toutes versions
Siemens	N/A	SIMATIC CP 1545-1 toutes versions
Siemens	N/A	NX 1980 Series versions antérieures à V1984
Siemens	N/A	SCALANCE X302-7 EEC toutes versions
Siemens	N/A	Desigo CC toutes versions with OIS Extension Module
Siemens	N/A	SCALANCE X308-2M PoE toutes versions
Siemens	N/A	SIMATIC CP 343-1 Lean (incl. SIPLUS variants) toutes versions
Siemens	N/A	RUGGEDCOM ROX RX5000 versions antérieures à V2.14.1
Siemens	N/A	SCALANCE XR324-12M TS toutes versions
Siemens	N/A	SIMATIC CP 343-1 ERPC toutes versions
Siemens	N/A	RUGGEDCOM ROX RX1524 versions antérieures à V2.14.1
Siemens	N/A	RUGGEDCOM ROX RX1510 versions antérieures à V2.14.1
Siemens	N/A	SIPROTEC 5 relays with CPU variants CP100 versions antérieures à V8.80
Siemens	N/A	SCALANCE X200-4P IRT toutes versions
Siemens	N/A	SIMATIC CP 343-1 (incl. SIPLUS variants) toutes versions
Siemens	N/A	SCALANCE XF201-3P IRT toutes versions
Siemens	N/A	SCALANCE X201-3P IRT PRO toutes versions
Siemens	N/A	Simcenter Femap V2021.1 toutes versions
Siemens	N/A	APOGEE PXC Compact (BACnet) versions antérieures à V3.5.3
Siemens	N/A	SCALANCE X310 toutes versions
Siemens	N/A	SIPROTEC 5 relays with CPU variants CP050 versions antérieures à V8.80
Siemens	N/A	SCALANCE X308-2M toutes versions
Siemens	N/A	SCALANCE XF208 versions antérieures à V5.2.5
Siemens	N/A	Teamcenter V12.4 versions antérieures à V12.4.0.8
Siemens	N/A	Desigo CC V4.2 toutes versions
Siemens	N/A	SCALANCE X206-1LD versions antérieures à V5.2.5
Siemens	N/A	SCALANCE XR324-12M toutes versions
Siemens	N/A	SCALANCE X216 versions antérieures à V5.2.5
Siemens	N/A	SCALANCE X308-2M TS toutes versions
Siemens	N/A	SCALANCE XF206-1 versions antérieures à V5.2.5
Siemens	N/A	SCALANCE X320-1-2LD FE toutes versions
Siemens	N/A	RUGGEDCOM ROX RX1536 versions antérieures à V2.14.1
Siemens	N/A	APOGEE PXC Modular (BACnet) versions antérieures à V3.5.3
Siemens	N/A	SCALANCE XR324-4M PoE TS toutes versions
Siemens	N/A	APOGEE PXC Compact (P2 Ethernet) toutes versions >= V2.8
Siemens	N/A	GMA-Manager toutes versions with OIS running on Debian 9 or earlier
Siemens	N/A	APOGEE MBC (PPC) (P2 Ethernet) toutes versions >= V2.6.3
Siemens	N/A	RUGGEDCOM ROX RX1512 versions antérieures à V2.14.1
Siemens	N/A	Desigo CC V4.1 toutes versions
Siemens	N/A	SCALANCE X304-2FE toutes versions
Siemens	N/A	SCALANCE XF202-2P IRT toutes versions
Siemens	N/A	SCALANCE X308-2LH toutes versions
Siemens	N/A	Desigo CC Compact V4.0 toutes versions
Siemens	N/A	Industrial Edge Management versions antérieures à V1.3
Siemens	N/A	Teamcenter V13.2 versions antérieures à 13.2.0.2
Siemens	N/A	SCALANCE X204-2TS versions antérieures à V5.2.5
Siemens	N/A	Cerberus DMS V4.2 toutes versions
Siemens	N/A	SCALANCE X204-2LD (incl. SIPLUS NET variant) versions antérieures à V5.2.5
Siemens	N/A	SCALANCE X204-2LD TS versions antérieures à V5.2.5
Siemens	N/A	SCALANCE X308-2LH+ toutes versions
Siemens	N/A	SCALANCE X204 IRT toutes versions
Siemens	N/A	SCALANCE X308-2LD toutes versions
Siemens	N/A	SCALANCE X201-3P IRT toutes versions
Siemens	N/A	SCALANCE XR324-4M PoE toutes versions
Siemens	N/A	Teamcenter Active Workspace V5.0 versions antérieures à V5.0.8
Siemens	N/A	SCALANCE X307-3 toutes versions
Siemens	N/A	Teamcenter V13.1 versions antérieures à V13.1.0.5
Siemens	N/A	Cerberus DMS V5.0 versions antérieures à v5.0 QU1
Siemens	N/A	SCALANCE XF204 IRT toutes versions
Siemens	N/A	Simcenter Femap V2020.2 toutes versions
Siemens	N/A	SCALANCE X212-2 (incl. SIPLUS NET variant) versions antérieures à V5.2.5
Siemens	N/A	Siveillance Control toutes versions with OIS running on Debian 9 or earlier
Siemens	N/A	Teamcenter Active Workspace V5.2 versions antérieures à V5.2.1
Siemens	N/A	SIMATIC CP 343-1 Advanced (incl. SIPLUS variants) toutes versions
Siemens	N/A	SCALANCE XF204-2 (incl. SIPLUS NET variant) versions antérieures à V5.2.5

References

Title

Publication Time

CERTFR-2021-AVI-706

Vulnerability from certfr_avis - Published: - Updated:

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Siemens	N/A	SINEMA Server versions antérieures à V14 SP3
Siemens	N/A	SIMATIC CP 1543-1 (incl. SIPLUS variants) versions antérieures à V3.0
Siemens	N/A	SCALANCE X212-2LD versions antérieures à V5.2.5
Siemens	N/A	SCALANCE X202-2 IRT toutes versions
Siemens	N/A	Desigo CC V4.0 toutes versions
Siemens	N/A	TALON TC Modular (BACnet) versions antérieures à V3.5.3
Siemens	N/A	SCALANCE X204-2FM versions antérieures à V5.2.5
Siemens	N/A	SCALANCE X320-1 FE toutes versions
Siemens	N/A	LOGO! CMR2040 versions antérieures à V2.2
Siemens	N/A	SIMATIC RF350M toutes versions
Siemens	N/A	SCALANCE X308-2 (incl. SIPLUS NET variant) toutes versions
Siemens	N/A	Desigo CC Compact V5.0 versions antérieures à V5.0 QU1
Siemens	N/A	SCALANCE XF204 versions antérieures à V5.2.5
Siemens	N/A	SCALANCE XF204-2BA IRT toutes versions
Siemens	N/A	SINEMA Remote Connect Server versions antérieures à V3.0 SP2
Siemens	N/A	Teamcenter Active Workspace V5.1 versions antérieures à V5.1.5
Siemens	N/A	SCALANCE X307-3LD toutes versions
Siemens	N/A	RUGGEDCOM ROX RX1511 versions antérieures à V2.14.1
Siemens	N/A	SCALANCE X204-2 (incl. SIPLUS NET variant) versions antérieures à V5.2.5
Siemens	N/A	SCALANCE XR324-4M EEC toutes versions
Siemens	N/A	SCALANCE X224 versions antérieures à V5.2.5
Siemens	N/A	Desigo CC V5.0 versions antérieures à V5.0 QU1
Siemens	N/A	Teamcenter V13.0 versions antérieures à V13.0.0.7
Siemens	N/A	SCALANCE X204 IRT PRO toutes versions
Siemens	N/A	TALON TC Compact (BACnet) versions antérieures à V3.5.3
Siemens	N/A	Simcenter STAR-CCM+ Viewer versions antérieures à V2021.2.1
Siemens	N/A	Teamcenter Active Workspace V4.3 versions antérieures à V4.3.10
Siemens	N/A	Cerberus DMS V4.0 toutes versions
Siemens	N/A	APOGEE MEC (PPC) (P2 Ethernet) toutes versions >= V2.6.3
Siemens	N/A	SIMATIC CP 443-1 (incl. SIPLUS variants) toutes versions
Siemens	N/A	SCALANCE X310FE toutes versions
Siemens	N/A	SCALANCE X206-1 versions antérieures à V5.2.5
Siemens	N/A	RUGGEDCOM ROX MX5000 versions antérieures à V2.14.1
Siemens	N/A	Desigo CC Compact V4.2 toutes versions
Siemens	N/A	Desigo CC Compact V4.1 toutes versions
Siemens	N/A	RUGGEDCOM ROX RX1500 versions antérieures à V2.14.1
Siemens	N/A	SCALANCE X208 (incl. SIPLUS NET variant) versions antérieures à V5.2.5
Siemens	N/A	SCALANCE X306-1LD FE toutes versions
Siemens	N/A	SIMATIC CP 443-1 Advanced (incl. SIPLUS variants) toutes versions
Siemens	N/A	Siveillance Control Pro toutes versions
Siemens	N/A	RUGGEDCOM ROX RX1501 versions antérieures à V2.14.1
Siemens	N/A	SCALANCE X202-2P IRT (incl. SIPLUS NET variant) toutes versions
Siemens	N/A	SINEC NMS versions antérieures à V1.0 SP1
Siemens	N/A	SIPROTEC 5 relays with CPU variants CP200 toutes versions
Siemens	N/A	SCALANCE X307-2 EEC toutes versions
Siemens	N/A	Cerberus DMS V4.1 toutes versions
Siemens	N/A	SIMATIC RTU 3000 family toutes versions
Siemens	N/A	SCALANCE X202-2P IRT PRO toutes versions
Siemens	N/A	LOGO! CMR2020 versions antérieures à V2.2
Siemens	N/A	Operation Scheduler toutes versions with OIS running on Debian 9 or earlier
Siemens	N/A	SCALANCE X208PRO versions antérieures à V5.2.5
Siemens	N/A	SCALANCE X408-2 toutes versions
Siemens	N/A	SIPROTEC 5 relays with CPU variants CP300 versions antérieures à V8.80
Siemens	N/A	RUGGEDCOM ROX RX1400 versions antérieures à V2.14.1
Siemens	N/A	APOGEE PXC Modular (P2 Ethernet) toutes versions >= V2.8
Siemens	N/A	SIMATIC RF650M toutes versions
Siemens	N/A	SIMATIC CP 1545-1 toutes versions
Siemens	N/A	NX 1980 Series versions antérieures à V1984
Siemens	N/A	SCALANCE X302-7 EEC toutes versions
Siemens	N/A	Desigo CC toutes versions with OIS Extension Module
Siemens	N/A	SCALANCE X308-2M PoE toutes versions
Siemens	N/A	SIMATIC CP 343-1 Lean (incl. SIPLUS variants) toutes versions
Siemens	N/A	RUGGEDCOM ROX RX5000 versions antérieures à V2.14.1
Siemens	N/A	SCALANCE XR324-12M TS toutes versions
Siemens	N/A	SIMATIC CP 343-1 ERPC toutes versions
Siemens	N/A	RUGGEDCOM ROX RX1524 versions antérieures à V2.14.1
Siemens	N/A	RUGGEDCOM ROX RX1510 versions antérieures à V2.14.1
Siemens	N/A	SIPROTEC 5 relays with CPU variants CP100 versions antérieures à V8.80
Siemens	N/A	SCALANCE X200-4P IRT toutes versions
Siemens	N/A	SIMATIC CP 343-1 (incl. SIPLUS variants) toutes versions
Siemens	N/A	SCALANCE XF201-3P IRT toutes versions
Siemens	N/A	SCALANCE X201-3P IRT PRO toutes versions
Siemens	N/A	Simcenter Femap V2021.1 toutes versions
Siemens	N/A	APOGEE PXC Compact (BACnet) versions antérieures à V3.5.3
Siemens	N/A	SCALANCE X310 toutes versions
Siemens	N/A	SIPROTEC 5 relays with CPU variants CP050 versions antérieures à V8.80
Siemens	N/A	SCALANCE X308-2M toutes versions
Siemens	N/A	SCALANCE XF208 versions antérieures à V5.2.5
Siemens	N/A	Teamcenter V12.4 versions antérieures à V12.4.0.8
Siemens	N/A	Desigo CC V4.2 toutes versions
Siemens	N/A	SCALANCE X206-1LD versions antérieures à V5.2.5
Siemens	N/A	SCALANCE XR324-12M toutes versions
Siemens	N/A	SCALANCE X216 versions antérieures à V5.2.5
Siemens	N/A	SCALANCE X308-2M TS toutes versions
Siemens	N/A	SCALANCE XF206-1 versions antérieures à V5.2.5
Siemens	N/A	SCALANCE X320-1-2LD FE toutes versions
Siemens	N/A	RUGGEDCOM ROX RX1536 versions antérieures à V2.14.1
Siemens	N/A	APOGEE PXC Modular (BACnet) versions antérieures à V3.5.3
Siemens	N/A	SCALANCE XR324-4M PoE TS toutes versions
Siemens	N/A	APOGEE PXC Compact (P2 Ethernet) toutes versions >= V2.8
Siemens	N/A	GMA-Manager toutes versions with OIS running on Debian 9 or earlier
Siemens	N/A	APOGEE MBC (PPC) (P2 Ethernet) toutes versions >= V2.6.3
Siemens	N/A	RUGGEDCOM ROX RX1512 versions antérieures à V2.14.1
Siemens	N/A	Desigo CC V4.1 toutes versions
Siemens	N/A	SCALANCE X304-2FE toutes versions
Siemens	N/A	SCALANCE XF202-2P IRT toutes versions
Siemens	N/A	SCALANCE X308-2LH toutes versions
Siemens	N/A	Desigo CC Compact V4.0 toutes versions
Siemens	N/A	Industrial Edge Management versions antérieures à V1.3
Siemens	N/A	Teamcenter V13.2 versions antérieures à 13.2.0.2
Siemens	N/A	SCALANCE X204-2TS versions antérieures à V5.2.5
Siemens	N/A	Cerberus DMS V4.2 toutes versions
Siemens	N/A	SCALANCE X204-2LD (incl. SIPLUS NET variant) versions antérieures à V5.2.5
Siemens	N/A	SCALANCE X204-2LD TS versions antérieures à V5.2.5
Siemens	N/A	SCALANCE X308-2LH+ toutes versions
Siemens	N/A	SCALANCE X204 IRT toutes versions
Siemens	N/A	SCALANCE X308-2LD toutes versions
Siemens	N/A	SCALANCE X201-3P IRT toutes versions
Siemens	N/A	SCALANCE XR324-4M PoE toutes versions
Siemens	N/A	Teamcenter Active Workspace V5.0 versions antérieures à V5.0.8
Siemens	N/A	SCALANCE X307-3 toutes versions
Siemens	N/A	Teamcenter V13.1 versions antérieures à V13.1.0.5
Siemens	N/A	Cerberus DMS V5.0 versions antérieures à v5.0 QU1
Siemens	N/A	SCALANCE XF204 IRT toutes versions
Siemens	N/A	Simcenter Femap V2020.2 toutes versions
Siemens	N/A	SCALANCE X212-2 (incl. SIPLUS NET variant) versions antérieures à V5.2.5
Siemens	N/A	Siveillance Control toutes versions with OIS running on Debian 9 or earlier
Siemens	N/A	Teamcenter Active Workspace V5.2 versions antérieures à V5.2.1
Siemens	N/A	SIMATIC CP 343-1 Advanced (incl. SIPLUS variants) toutes versions
Siemens	N/A	SCALANCE XF204-2 (incl. SIPLUS NET variant) versions antérieures à V5.2.5

References

Title

Publication Time

CNVD-2021-71442

Vulnerability from cnvd - Published: 2021-09-16

Title

Siemens Siveillance OIS操作系统命令注入漏洞

Description

Siemens Desigo CC是德国西门子（Siemens）公司的一款开放式楼宇管理平台。GMA Manager允许将不同的安全和安保系统（如火灾探测系统和视频监控）功能性地结合在一个通用平台上。Operation Scheduler是一种使安全操作员能够智能地执行日常任务的工具。Siveillance Control是一个物理安全信息管理系统（PSIM）。Siveillance Control Pro是一种命令和控制解决方案。Siveillance Open Interface Services (OIS)是一个接口和集成平台，用于将子系统集成到管理站中。 Siemens Siveillance OIS存在操作系统命令注入漏洞，该漏洞是由于受影响的应用程序错误地中和特定HTTP GET请求中的特殊元素，未经身份验证的远程攻击者可利用此漏洞以root权限在系统上执行任意代码。

Severity

高

Patch Name

Siemens Siveillance OIS操作系统命令注入漏洞的补丁

Patch Description

Formal description

用户可参考如下供应商提供的安全公告获得补丁信息： https://cert-portal.siemens.com/productcert/pdf/ssa-535380.pdf

Reference

https://cert-portal.siemens.com/productcert/pdf/ssa-535380.pdf

Impacted products

Name
['Siemens Desigo CC', 'Siemens GMA-Manager', 'Siemens Operation Scheduler', 'Siemens Siveillance Control', 'Siemens Siveillance Control Pro']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2021-31891"
    }
  },
  "description": "Siemens Desigo CC\u662f\u5fb7\u56fd\u897f\u95e8\u5b50\uff08Siemens\uff09\u516c\u53f8\u7684\u4e00\u6b3e\u5f00\u653e\u5f0f\u697c\u5b87\u7ba1\u7406\u5e73\u53f0\u3002GMA Manager\u5141\u8bb8\u5c06\u4e0d\u540c\u7684\u5b89\u5168\u548c\u5b89\u4fdd\u7cfb\u7edf\uff08\u5982\u706b\u707e\u63a2\u6d4b\u7cfb\u7edf\u548c\u89c6\u9891\u76d1\u63a7\uff09\u529f\u80fd\u6027\u5730\u7ed3\u5408\u5728\u4e00\u4e2a\u901a\u7528\u5e73\u53f0\u4e0a \u3002Operation Scheduler\u662f\u4e00\u79cd\u4f7f\u5b89\u5168\u64cd\u4f5c\u5458\u80fd\u591f\u667a\u80fd\u5730\u6267\u884c\u65e5\u5e38\u4efb\u52a1\u7684\u5de5\u5177\u3002Siveillance Control\u662f\u4e00\u4e2a\u7269\u7406\u5b89\u5168\u4fe1\u606f\u7ba1\u7406\u7cfb\u7edf\uff08PSIM\uff09\u3002Siveillance Control Pro\u662f\u4e00\u79cd\u547d\u4ee4\u548c\u63a7\u5236\u89e3\u51b3\u65b9\u6848\u3002Siveillance Open Interface Services (OIS)\u662f\u4e00\u4e2a\u63a5\u53e3\u548c\u96c6\u6210\u5e73\u53f0\uff0c\u7528\u4e8e\u5c06\u5b50\u7cfb\u7edf\u96c6\u6210\u5230\u7ba1\u7406\u7ad9\u4e2d\u3002\n\nSiemens Siveillance OIS\u5b58\u5728\u64cd\u4f5c\u7cfb\u7edf\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u662f\u7531\u4e8e\u53d7\u5f71\u54cd\u7684\u5e94\u7528\u7a0b\u5e8f\u9519\u8bef\u5730\u4e2d\u548c\u7279\u5b9aHTTP GET\u8bf7\u6c42\u4e2d\u7684\u7279\u6b8a\u5143\u7d20\uff0c\u672a\u7ecf\u8eab\u4efd\u9a8c\u8bc1\u7684\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u6b64\u6f0f\u6d1e\u4ee5root\u6743\u9650\u5728\u7cfb\u7edf\u4e0a\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002",
  "formalWay": "\u7528\u6237\u53ef\u53c2\u8003\u5982\u4e0b\u4f9b\u5e94\u5546\u63d0\u4f9b\u7684\u5b89\u5168\u516c\u544a\u83b7\u5f97\u8865\u4e01\u4fe1\u606f\uff1a\r\nhttps://cert-portal.siemens.com/productcert/pdf/ssa-535380.pdf",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-71442",
  "openTime": "2021-09-16",
  "patchDescription": "Siemens Desigo CC\u662f\u5fb7\u56fd\u897f\u95e8\u5b50\uff08Siemens\uff09\u516c\u53f8\u7684\u4e00\u6b3e\u5f00\u653e\u5f0f\u697c\u5b87\u7ba1\u7406\u5e73\u53f0\u3002GMA Manager\u5141\u8bb8\u5c06\u4e0d\u540c\u7684\u5b89\u5168\u548c\u5b89\u4fdd\u7cfb\u7edf\uff08\u5982\u706b\u707e\u63a2\u6d4b\u7cfb\u7edf\u548c\u89c6\u9891\u76d1\u63a7\uff09\u529f\u80fd\u6027\u5730\u7ed3\u5408\u5728\u4e00\u4e2a\u901a\u7528\u5e73\u53f0\u4e0a \u3002Operation Scheduler\u662f\u4e00\u79cd\u4f7f\u5b89\u5168\u64cd\u4f5c\u5458\u80fd\u591f\u667a\u80fd\u5730\u6267\u884c\u65e5\u5e38\u4efb\u52a1\u7684\u5de5\u5177\u3002Siveillance Control\u662f\u4e00\u4e2a\u7269\u7406\u5b89\u5168\u4fe1\u606f\u7ba1\u7406\u7cfb\u7edf\uff08PSIM\uff09\u3002Siveillance Control Pro\u662f\u4e00\u79cd\u547d\u4ee4\u548c\u63a7\u5236\u89e3\u51b3\u65b9\u6848\u3002Siveillance Open Interface Services (OIS)\u662f\u4e00\u4e2a\u63a5\u53e3\u548c\u96c6\u6210\u5e73\u53f0\uff0c\u7528\u4e8e\u5c06\u5b50\u7cfb\u7edf\u96c6\u6210\u5230\u7ba1\u7406\u7ad9\u4e2d\u3002\r\n\r\nSiemens Siveillance OIS\u5b58\u5728\u64cd\u4f5c\u7cfb\u7edf\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u662f\u7531\u4e8e\u53d7\u5f71\u54cd\u7684\u5e94\u7528\u7a0b\u5e8f\u9519\u8bef\u5730\u4e2d\u548c\u7279\u5b9aHTTP GET\u8bf7\u6c42\u4e2d\u7684\u7279\u6b8a\u5143\u7d20\uff0c\u672a\u7ecf\u8eab\u4efd\u9a8c\u8bc1\u7684\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u6b64\u6f0f\u6d1e\u4ee5root\u6743\u9650\u5728\u7cfb\u7edf\u4e0a\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Siemens Siveillance OIS\u64cd\u4f5c\u7cfb\u7edf\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Siemens Desigo CC",
      "Siemens GMA-Manager",
      "Siemens Operation Scheduler",
      "Siemens Siveillance Control",
      "Siemens Siveillance Control Pro"
    ]
  },
  "referenceLink": "https://cert-portal.siemens.com/productcert/pdf/ssa-535380.pdf",
  "serverity": "\u9ad8",
  "submitTime": "2021-09-15",
  "title": "Siemens Siveillance OIS\u64cd\u4f5c\u7cfb\u7edf\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e"
}

FKIE_CVE-2021-31891

Vulnerability from fkie_nvd - Published: 2021-09-14 11:15 - Updated: 2024-11-21 06:06

Severity

10.0 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Summary

References

	URL	Tags
	productcert@siemens.com	https://cert-portal.siemens.com/productcert/pdf/ssa-535380.pdf	Patch, Vendor Advisory
	af854a3a-2127-422b-91ae-364da2661108	https://cert-portal.siemens.com/productcert/pdf/ssa-535380.pdf	Patch, Vendor Advisory

Impacted products

Vendor	Product	Version
siemens	desigo_cc	*
siemens	siveillance_control_pro	*
siemens	gma-manager	*
siemens	operation_scheduler	*
siemens	siveillance_control	*
debian	debian_linux	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:siemens:desigo_cc:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "90D75ECA-E171-42BD-A475-A1DD4B9BE013",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:siemens:siveillance_control_pro:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6D1D6B61-1F17-4008-9DFB-EF419777768E",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:siemens:gma-manager:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E2504273-D83D-462E-A8CF-09107517D75D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:siemens:operation_scheduler:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "DFB86317-9626-454A-89D3-2B96FDF84CC3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:siemens:siveillance_control:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F5A18694-B44A-424A-8811-0D0E4FD729A8",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B79BD779-60A5-43A8-9229-07C11A3167AA",
              "versionEndIncluding": "9.0",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability has been identified in Desigo CC (All versions with OIS Extension Module), GMA-Manager (All versions with OIS running on Debian 9 or earlier), Operation Scheduler (All versions with OIS running on Debian 9 or earlier), Siveillance Control (All versions with OIS running on Debian 9 or earlier), Siveillance Control Pro (All versions). The affected application incorrectly neutralizes special elements in a specific HTTP GET request which could lead to command injection. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary code on the system with root privileges."
    },
    {
      "lang": "es",
      "value": "Se ha identificado una vulnerabilidad en Desigo CC (Todas las versiones con m\u00f3dulo de extensi\u00f3n OIS), GMA-Manager (Todas las versiones con OIS que se ejecutan en Debian 9 o anterior), Operation Scheduler (Todas las versiones con OIS que se ejecutan en Debian 9 o anterior), Siveillance Control (Todas las versiones con OIS que se ejecutan en Debian 9 o anterior), Siveillance Control Pro (Todas las versiones). La aplicaci\u00f3n afectada neutraliza incorrectamente elementos especiales en una petici\u00f3n HTTP GET espec\u00edfica que podr\u00eda conllevar a una inyecci\u00f3n de comandos. Un atacante remoto no autenticado podr\u00eda aprovechar esta vulnerabilidad para ejecutar c\u00f3digo arbitrario en el sistema con privilegios de root"
    }
  ],
  "id": "CVE-2021-31891",
  "lastModified": "2024-11-21T06:06:26.703",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 10.0,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 10.0,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 6.0,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2021-09-14T11:15:24.023",
  "references": [
    {
      "source": "productcert@siemens.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-535380.pdf"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-535380.pdf"
    }
  ],
  "sourceIdentifier": "productcert@siemens.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ],
      "source": "productcert@siemens.com",
      "type": "Secondary"
    }
  ]
}

GHSA-CH26-285Q-M7W2

Vulnerability from github – Published: 2022-05-24 19:14 – Updated: 2022-05-24 19:14

Details

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2021-31891"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-09-14T11:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "A vulnerability has been identified in Desigo CC (All versions with OIS Extension Module), GMA-Manager (All versions with OIS running on Debian 9 or earlier), Operation Scheduler (All versions with OIS running on Debian 9 or earlier), Siveillance Control (All versions with OIS running on Debian 9 or earlier), Siveillance Control Pro (All versions). The affected application incorrectly neutralizes special elements in a specific HTTP GET request which could lead to command injection. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary code on the system with root privileges.",
  "id": "GHSA-ch26-285q-m7w2",
  "modified": "2022-05-24T19:14:32Z",
  "published": "2022-05-24T19:14:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-31891"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-535380.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GSD-2021-31891

Vulnerability from gsd - Updated: 2023-12-13 01:23

Details

Aliases

CVE-2021-31891

Aliases

CVE-2021-31891

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2021-31891",
    "description": "A vulnerability has been identified in Desigo CC (All versions with OIS Extension Module), GMA-Manager (All versions with OIS running on Debian 9 or earlier), Operation Scheduler (All versions with OIS running on Debian 9 or earlier), Siveillance Control (All versions with OIS running on Debian 9 or earlier), Siveillance Control Pro (All versions). The affected application incorrectly neutralizes special elements in a specific HTTP GET request which could lead to command injection. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary code on the system with root privileges.",
    "id": "GSD-2021-31891"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2021-31891"
      ],
      "details": "A vulnerability has been identified in Desigo CC (All versions with OIS Extension Module), GMA-Manager (All versions with OIS running on Debian 9 or earlier), Operation Scheduler (All versions with OIS running on Debian 9 or earlier), Siveillance Control (All versions with OIS running on Debian 9 or earlier), Siveillance Control Pro (All versions). The affected application incorrectly neutralizes special elements in a specific HTTP GET request which could lead to command injection. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary code on the system with root privileges.",
      "id": "GSD-2021-31891",
      "modified": "2023-12-13T01:23:12.913055Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "productcert@siemens.com",
        "ID": "CVE-2021-31891",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Desigo CC",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "All versions with OIS Extension Module"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "GMA-Manager",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "All versions with OIS running on Debian 9 or earlier"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Operation Scheduler",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "All versions with OIS running on Debian 9 or earlier"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Siveillance Control",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "All versions with OIS running on Debian 9 or earlier"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Siveillance Control Pro",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "All versions"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Siemens"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "A vulnerability has been identified in Desigo CC (All versions with OIS Extension Module), GMA-Manager (All versions with OIS running on Debian 9 or earlier), Operation Scheduler (All versions with OIS running on Debian 9 or earlier), Siveillance Control (All versions with OIS running on Debian 9 or earlier), Siveillance Control Pro (All versions). The affected application incorrectly neutralizes special elements in a specific HTTP GET request which could lead to command injection. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary code on the system with root privileges."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-535380.pdf",
            "refsource": "MISC",
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-535380.pdf"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:siemens:desigo_cc:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:siemens:siveillance_control_pro:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:siemens:gma-manager:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:siemens:operation_scheduler:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:siemens:siveillance_control:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:debian:debian_linux:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndIncluding": "9.0",
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "productcert@siemens.com",
          "ID": "CVE-2021-31891"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "A vulnerability has been identified in Desigo CC (All versions with OIS Extension Module), GMA-Manager (All versions with OIS running on Debian 9 or earlier), Operation Scheduler (All versions with OIS running on Debian 9 or earlier), Siveillance Control (All versions with OIS running on Debian 9 or earlier), Siveillance Control Pro (All versions). The affected application incorrectly neutralizes special elements in a specific HTTP GET request which could lead to command injection. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary code on the system with root privileges."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-78"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-535380.pdf",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-535380.pdf"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "COMPLETE",
            "baseScore": 10.0,
            "confidentialityImpact": "COMPLETE",
            "integrityImpact": "COMPLETE",
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 10.0,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "HIGH",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 10.0,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 6.0
        }
      },
      "lastModifiedDate": "2021-09-28T16:48Z",
      "publishedDate": "2021-09-14T11:15Z"
    }
  }
}

ICSA-21-257-18

Vulnerability from csaf_cisa - Published: 2021-09-14 00:00 - Updated: 2025-05-06 06:00

Summary

Siemens Siveillance OIS

Notes

Summary: The Siveillance Open Interface Services (OIS) application used for integration of different subsystems to several Siemens building management systems contains a command injection vulnerability that could allow a remote unauthenticated attacker to execute code on the affected system with root privileges. Siemens has released patches and updates for Siveillance OIS to apply to the products that incorporate the OIS service, and recommends to update to the latest versions.

General Recommendations: As a general security measure Siemens strongly recommends to protect network access to affected products with appropriate mechanisms. It is advised to follow recommended security practices in order to run the devices in a protected IT environment.

Additional Resources: For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories

Terms of Use: Siemens Security Advisories are subject to the terms and conditions contained in Siemens' underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter "License Terms"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens' Global Website (https://www.siemens.com/terms_of_use, hereinafter "Terms of Use"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.

Legal Notice: All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.

Advisory Conversion Disclaimer: This CISA CSAF advisory was converted from Siemens ProductCERT's CSAF advisory.

Critical infrastructure sectors: Multiple

Countries/areas deployed: Worldwide

Company headquarters location: Germany

Recommended Practices: CISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.

Recommended Practices: Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.

Recommended Practices: Locate control system networks and remote devices behind firewalls and isolate them from business networks.

Recommended Practices: When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.

Recommended Practices: CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

Recommended Practices: CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

Recommended Practices: CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Recommended Practices: Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CVE-2021-31891

10.0 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected products

Known affected 5 products

Product	Version	Remediation
Desigo CC Siemens / Desigo CC	All_versions_with_OIS_Extension_Module	Vendor Fix fix Mitigation Mitigation
GMA-Manager Siemens / GMA-Manager	<=with_OIS_running_on_Debian_9	Vendor Fix fix Mitigation Mitigation
Operation Scheduler Siemens / Operation Scheduler	<=with_OIS_running_on_Debian_9	Vendor Fix fix Mitigation Mitigation
Siveillance Control Siemens / Siveillance Control	<=with_OIS_running_on_Debian_9	Vendor Fix fix Mitigation Mitigation
Siveillance Control Pro Siemens / Siveillance Control Pro	vers:all/*	Vendor Fix fix Mitigation Mitigation

References

17 references

URL	Category
https://cert-portal.siemens.com/productcert/csaf/…	self
https://cert-portal.siemens.com/productcert/txt/s…	self
https://cert-portal.siemens.com/productcert/pdf/s…	self
https://raw.githubusercontent.com/cisagov/CSAF/de…	self
https://www.cisa.gov/news-events/ics-advisories/i…	self
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-…	external
https://www.cisa.gov/resources-tools/resources/ic…	external
https://www.cisa.gov/topics/industrial-control-systems	external
https://us-cert.cisa.gov/sites/default/files/reco…	external
https://www.cisa.gov/sites/default/files/publicat…	external
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B	external
https://support.industry.siemens.com/cs/ww/en/vie…
https://support.industry.siemens.com/cs/ww/en/vie…
https://support.industry.siemens.com/cs/ww/en/vie…
https://support.industry.siemens.com/cs/ww/en/vie…
https://support.industry.siemens.com/cs/ww/en/vie…
https://cert-portal.siemens.com/productcert/mitre…

Acknowledgments

Siemens ProductCERT

JSON

To clipboard

{
  "document": {
    "acknowledgments": [
      {
        "organization": "Siemens ProductCERT",
        "summary": "reporting this vulnerability to CISA."
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp/"
      }
    },
    "notes": [
      {
        "category": "summary",
        "text": "The Siveillance Open Interface Services (OIS) application used for integration of different subsystems to several Siemens building management systems contains a command injection vulnerability that could allow a remote unauthenticated attacker to execute code on the affected system with root privileges.\n\nSiemens has released patches and updates for Siveillance OIS to apply to the products that incorporate the OIS service, and recommends to update to the latest versions.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure Siemens strongly recommends to protect network access to affected products with appropriate mechanisms. It is advised to follow recommended security practices in order to run the devices in a protected IT environment.",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
        "title": "Terms of Use"
      },
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "other",
        "text": "This CISA CSAF advisory was converted from Siemens ProductCERT\u0027s CSAF advisory.",
        "title": "Advisory Conversion Disclaimer"
      },
      {
        "category": "other",
        "text": "Multiple",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "Germany",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "CISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "central@cisa.dhs.gov",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-535380: Command Injection Vulnerability in Siveillance OIS Affecting Several Building Management Systems - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-535380.json"
      },
      {
        "category": "self",
        "summary": "SSA-535380: Command Injection Vulnerability in Siveillance OIS Affecting Several Building Management Systems - TXT Version",
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-535380.txt"
      },
      {
        "category": "self",
        "summary": "SSA-535380: Command Injection Vulnerability in Siveillance OIS Affecting Several Building Management Systems - PDF Version",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-535380.pdf"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-21-257-18 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2021/icsa-21-257-18.json"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-21-257-18 - Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-257-18"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/topics/industrial-control-systems"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
      }
    ],
    "title": "Siemens Siveillance OIS",
    "tracking": {
      "current_release_date": "2025-05-06T06:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ICSA-21-257-18",
      "initial_release_date": "2021-09-14T00:00:00.000000Z",
      "revision_history": [
        {
          "date": "2021-09-14T00:00:00.000000Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        },
        {
          "date": "2025-05-06T06:00:00.000000Z",
          "legacy_version": "Revision",
          "number": "2",
          "summary": "Revision - Fixing typos"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "All_versions_with_OIS_Extension_Module",
                "product": {
                  "name": "Desigo CC",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "Desigo CC"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c=with_OIS_running_on_Debian_9",
                "product": {
                  "name": "GMA-Manager",
                  "product_id": "CSAFPID-0002"
                }
              }
            ],
            "category": "product_name",
            "name": "GMA-Manager"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c=with_OIS_running_on_Debian_9",
                "product": {
                  "name": "Operation Scheduler",
                  "product_id": "CSAFPID-0003"
                }
              }
            ],
            "category": "product_name",
            "name": "Operation Scheduler"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c=with_OIS_running_on_Debian_9",
                "product": {
                  "name": "Siveillance Control",
                  "product_id": "CSAFPID-0004"
                }
              }
            ],
            "category": "product_name",
            "name": "Siveillance Control"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Siveillance Control Pro",
                  "product_id": "CSAFPID-0005"
                }
              }
            ],
            "category": "product_name",
            "name": "Siveillance Control Pro"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-31891",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The affected application incorrectly neutralizes special elements in a specific HTTP GET request which could lead to command injection.\n\nAn unauthenticated remote attacker could exploit this vulnerability to execute arbitrary code on the system with root privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005"
        ]
      },
      "references": [
        {
          "summary": "CVE-2021-31891 - Desigo CC",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109799908/"
        },
        {
          "summary": "CVE-2021-31891 - GMA-Manager",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109799908/"
        },
        {
          "summary": "CVE-2021-31891 - Operation Scheduler",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109799908/"
        },
        {
          "summary": "CVE-2021-31891 - Siveillance Control",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109799908/"
        },
        {
          "summary": "CVE-2021-31891 - Siveillance Control Pro",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109799908/"
        },
        {
          "summary": "CVE-2021-31891 Mitre 5.0 json",
          "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-31891.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update the OIS to V2.5.3 or apply the patch",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109799908/"
        },
        {
          "category": "vendor_fix",
          "details": "Update the OIS to V2.5.3 or V2.6.1, or apply the patch",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109799908/"
        },
        {
          "category": "vendor_fix",
          "details": "Update the OIS to V2.5.3 or V2.6.0, or apply the patch",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109799908/"
        },
        {
          "category": "mitigation",
          "details": "Ensure that the systems where Siveillance OIS is installed are only accessible by trusted personnel",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005"
          ]
        },
        {
          "category": "mitigation",
          "details": "Restrict access to the affected systems, especially to port 443/tcp, to trusted IP addresses only",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 10.0,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005"
          ]
        }
      ],
      "title": "CVE-2021-31891"
    }
  ]
}

SSA-535380

Vulnerability from csaf_siemens - Published: 2021-09-14 00:00 - Updated: 2021-09-14 00:00

Summary

SSA-535380: Command Injection Vulnerability in Siveillance OIS Affecting Several Building Management Systems

Notes

Additional Resources: For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories

CVE-2021-31891

10.0 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected products

Known affected 5 products

Product	Version	Remediation
Desigo CC Siemens / Desigo CC	All versions with OIS Extension Module	Vendor Fix fix Mitigation Mitigation
GMA-Manager Siemens / GMA-Manager	All versions with OIS running on Debian 9 or earlier	Vendor Fix fix Mitigation Mitigation
Operation Scheduler Siemens / Operation Scheduler	All versions with OIS running on Debian 9 or earlier	Vendor Fix fix Mitigation Mitigation
Siveillance Control Siemens / Siveillance Control	All versions with OIS running on Debian 9 or earlier	Vendor Fix fix Mitigation Mitigation
Siveillance Control Pro Siemens / Siveillance Control Pro	vers:all/*	Vendor Fix fix Mitigation Mitigation

References

9 references

URL	Category
https://cert-portal.siemens.com/productcert/pdf/s…	self
https://cert-portal.siemens.com/productcert/txt/s…	self
https://cert-portal.siemens.com/productcert/csaf/…	self
https://support.industry.siemens.com/cs/ww/en/vie…
https://support.industry.siemens.com/cs/ww/en/vie…
https://support.industry.siemens.com/cs/ww/en/vie…
https://support.industry.siemens.com/cs/ww/en/vie…
https://support.industry.siemens.com/cs/ww/en/vie…
https://cert-portal.siemens.com/productcert/mitre…

JSON

To clipboard

{
  "document": {
    "category": "Siemens Security Advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited.",
      "tlp": {
        "label": "WHITE"
      }
    },
    "notes": [
      {
        "category": "summary",
        "text": "The Siveillance Open Interface Services (OIS) application used for integration of different subsystems to several Siemens building management systems contains a command injection vulnerability that could allow a remote unauthenticated attacker to execute code on the affected system with root privileges.\n\nSiemens has released patches and updates for Siveillance OIS to apply to the products that incorporate the OIS service, and recommends to update to the latest versions.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure Siemens strongly recommends to protect network access to affected products with appropriate mechanisms. It is advised to follow recommended security practices in order to run the devices in a protected IT environment.",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "productcert@siemens.com",
      "name": "Siemens ProductCERT",
      "namespace": "https://www.siemens.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-535380: Command Injection Vulnerability in Siveillance OIS Affecting Several Building Management Systems - PDF Version",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-535380.pdf"
      },
      {
        "category": "self",
        "summary": "SSA-535380: Command Injection Vulnerability in Siveillance OIS Affecting Several Building Management Systems - TXT Version",
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-535380.txt"
      },
      {
        "category": "self",
        "summary": "SSA-535380: Command Injection Vulnerability in Siveillance OIS Affecting Several Building Management Systems - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-535380.json"
      }
    ],
    "title": "SSA-535380: Command Injection Vulnerability in Siveillance OIS Affecting Several Building Management Systems",
    "tracking": {
      "current_release_date": "2021-09-14T00:00:00Z",
      "generator": {
        "engine": {
          "name": "Siemens ProductCERT CSAF Generator",
          "version": "1"
        }
      },
      "id": "SSA-535380",
      "initial_release_date": "2021-09-14T00:00:00Z",
      "revision_history": [
        {
          "date": "2021-09-14T00:00:00Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "All versions with OIS Extension Module",
                "product": {
                  "name": "Desigo CC",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "Desigo CC"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "All versions with OIS running on Debian 9 or earlier",
                "product": {
                  "name": "GMA-Manager",
                  "product_id": "2"
                }
              }
            ],
            "category": "product_name",
            "name": "GMA-Manager"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "All versions with OIS running on Debian 9 or earlier",
                "product": {
                  "name": "Operation Scheduler",
                  "product_id": "3"
                }
              }
            ],
            "category": "product_name",
            "name": "Operation Scheduler"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "All versions with OIS running on Debian 9 or earlier",
                "product": {
                  "name": "Siveillance Control",
                  "product_id": "4"
                }
              }
            ],
            "category": "product_name",
            "name": "Siveillance Control"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Siveillance Control Pro",
                  "product_id": "5"
                }
              }
            ],
            "category": "product_name",
            "name": "Siveillance Control Pro"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-31891",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The affected application incorrectly neutralizes special elements in a specific HTTP GET request which could lead to command injection.\n\nAn unauthenticated remote attacker could exploit this vulnerability to execute arbitrary code on the system with root privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5"
        ]
      },
      "references": [
        {
          "summary": "CVE-2021-31891 - Desigo CC",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109799908/"
        },
        {
          "summary": "CVE-2021-31891 - GMA-Manager",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109799908/"
        },
        {
          "summary": "CVE-2021-31891 - Operation Scheduler",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109799908/"
        },
        {
          "summary": "CVE-2021-31891 - Siveillance Control",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109799908/"
        },
        {
          "summary": "CVE-2021-31891 - Siveillance Control Pro",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109799908/"
        },
        {
          "summary": "CVE-2021-31891 Mitre 5.0 json",
          "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-31891.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update the OIS to V2.5.3 or apply the patch",
          "product_ids": [
            "1",
            "2",
            "3"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109799908/"
        },
        {
          "category": "vendor_fix",
          "details": "Update the OIS to V2.5.3 or V2.6.1, or apply the patch",
          "product_ids": [
            "4"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109799908/"
        },
        {
          "category": "vendor_fix",
          "details": "Update the OIS to V2.5.3 or V2.6.0, or apply the patch",
          "product_ids": [
            "5"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109799908/"
        },
        {
          "category": "mitigation",
          "details": "Ensure that the systems where Siveillance OIS is installed are only accessible by trusted personnel",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5"
          ]
        },
        {
          "category": "mitigation",
          "details": "Restrict access to the affected systems, especially to port 443/tcp, to trusted IP addresses only",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 10.0,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5"
          ]
        }
      ],
      "title": "CVE-2021-31891"
    }
  ]
}

VAR-202109-0743

Vulnerability from variot - Updated: 2023-12-18 11:09

A vulnerability has been identified in Desigo CC (All versions with OIS Extension Module), GMA-Manager (All versions with OIS running on Debian 9 or earlier), Operation Scheduler (All versions with OIS running on Debian 9 or earlier), Siveillance Control (All versions with OIS running on Debian 9 or earlier), Siveillance Control Pro (All versions). The affected application incorrectly neutralizes special elements in a specific HTTP GET request which could lead to command injection. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary code on the system with root privileges. Several Siemens products include OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Siemens Desigo CC is an open building management platform from Siemens (Siemens) in Germany. GMA Manager allows the functional combination of different safety and security systems, such as fire detection systems and video surveillance, on a common platform. Operation Scheduler is a tool that enables security operators to intelligently perform routine tasks. Siveillance Control is a Physical Security Information Management System (PSIM). Siveillance Control Pro is a command and control solution. Siveillance Open Interface Services (OIS) is an interface and integration platform for integrating subsystems into management stations. Pillow is a Python-based image processing library. There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202109-0743",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "siveillance control pro",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "*"
      },
      {
        "model": "operation scheduler",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "*"
      },
      {
        "model": "gma-manager",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "*"
      },
      {
        "model": "siveillance control",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "*"
      },
      {
        "model": "desigo cc",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "*"
      },
      {
        "model": "siveillance control",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30b7\u30fc\u30e1\u30f3\u30b9",
        "version": null
      },
      {
        "model": "siveillance control pro",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30b7\u30fc\u30e1\u30f3\u30b9",
        "version": null
      },
      {
        "model": "desigo cc",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30b7\u30fc\u30e1\u30f3\u30b9",
        "version": null
      },
      {
        "model": "operation scheduler",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30b7\u30fc\u30e1\u30f3\u30b9",
        "version": null
      },
      {
        "model": "gma-manager",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30b7\u30fc\u30e1\u30f3\u30b9",
        "version": null
      },
      {
        "model": "desigo cc",
        "scope": null,
        "trust": 0.6,
        "vendor": "siemens",
        "version": null
      },
      {
        "model": "gma-manager",
        "scope": null,
        "trust": 0.6,
        "vendor": "siemens",
        "version": null
      },
      {
        "model": "operation scheduler",
        "scope": null,
        "trust": 0.6,
        "vendor": "siemens",
        "version": null
      },
      {
        "model": "siveillance control",
        "scope": null,
        "trust": 0.6,
        "vendor": "siemens",
        "version": null
      },
      {
        "model": "siveillance control pro",
        "scope": null,
        "trust": 0.6,
        "vendor": "siemens",
        "version": null
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2021-71442"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-012333"
      },
      {
        "db": "NVD",
        "id": "CVE-2021-31891"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:siemens:desigo_cc:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:siemens:siveillance_control_pro:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:siemens:gma-manager:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:siemens:operation_scheduler:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:siemens:siveillance_control:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:debian:debian_linux:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndIncluding": "9.0",
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2021-31891"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Siemens reported this vulnerability to CISA.",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202109-931"
      }
    ],
    "trust": 0.6
  },
  "cve": "CVE-2021-31891",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 10.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 10.0,
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "HIGH",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "Complete",
            "baseScore": 10.0,
            "confidentialityImpact": "Complete",
            "exploitabilityScore": null,
            "id": "CVE-2021-31891",
            "impactScore": null,
            "integrityImpact": "Complete",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "High",
            "trust": 0.9,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "CNVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 10.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 10.0,
            "id": "CNVD-2021-71442",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.6,
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "NVD",
            "availabilityImpact": "HIGH",
            "baseScore": 10.0,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 3.9,
            "impactScore": 6.0,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 10.0,
            "baseSeverity": "Critical",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2021-31891",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "None",
            "scope": "Changed",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2021-31891",
            "trust": 1.8,
            "value": "CRITICAL"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2021-71442",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202104-975",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202109-931",
            "trust": 0.6,
            "value": "CRITICAL"
          },
          {
            "author": "VULMON",
            "id": "CVE-2021-31891",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2021-71442"
      },
      {
        "db": "VULMON",
        "id": "CVE-2021-31891"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-012333"
      },
      {
        "db": "NVD",
        "id": "CVE-2021-31891"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-975"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202109-931"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "A vulnerability has been identified in Desigo CC (All versions with OIS Extension Module), GMA-Manager (All versions with OIS running on Debian 9 or earlier), Operation Scheduler (All versions with OIS running on Debian 9 or earlier), Siveillance Control (All versions with OIS running on Debian 9 or earlier), Siveillance Control Pro (All versions). The affected application incorrectly neutralizes special elements in a specific HTTP GET request which could lead to command injection. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary code on the system with root privileges. Several Siemens products include OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Siemens Desigo CC is an open building management platform from Siemens (Siemens) in Germany. GMA Manager allows the functional combination of different safety and security systems, such as fire detection systems and video surveillance, on a common platform. Operation Scheduler is a tool that enables security operators to intelligently perform routine tasks. Siveillance Control is a Physical Security Information Management System (PSIM). Siveillance Control Pro is a command and control solution. Siveillance Open Interface Services (OIS) is an interface and integration platform for integrating subsystems into management stations. Pillow is a Python-based image processing library. \nThere is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2021-31891"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-012333"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2021-71442"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-975"
      },
      {
        "db": "VULMON",
        "id": "CVE-2021-31891"
      }
    ],
    "trust": 2.79
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2021-31891",
        "trust": 3.9
      },
      {
        "db": "SIEMENS",
        "id": "SSA-535380",
        "trust": 2.3
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-21-257-18",
        "trust": 1.4
      },
      {
        "db": "JVN",
        "id": "JVNVU96712416",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-012333",
        "trust": 0.8
      },
      {
        "db": "CNVD",
        "id": "CNVD-2021-71442",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2021041363",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-975",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2021091605",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202109-931",
        "trust": 0.6
      },
      {
        "db": "VULMON",
        "id": "CVE-2021-31891",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2021-71442"
      },
      {
        "db": "VULMON",
        "id": "CVE-2021-31891"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-012333"
      },
      {
        "db": "NVD",
        "id": "CVE-2021-31891"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-975"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202109-931"
      }
    ]
  },
  "id": "VAR-202109-0743",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2021-71442"
      }
    ],
    "trust": 1.25833334
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "ICS"
        ],
        "sub_category": null,
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2021-71442"
      }
    ]
  },
  "last_update_date": "2023-12-18T11:09:20.814000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "SSA-535380",
        "trust": 0.8,
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-535380.pdf"
      },
      {
        "title": "Patch for Siemens Siveillance OIS Operating System Command Injection Vulnerability",
        "trust": 0.6,
        "url": "https://www.cnvd.org.cn/patchinfo/show/291001"
      },
      {
        "title": "Siemens Desigo CC Fixes for operating system command injection vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=162466"
      },
      {
        "title": "Siemens Security Advisories: Siemens Security Advisory",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=siemens_security_advisories\u0026qid=272f30a8fc81104e9158fca291f370ba"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2021-71442"
      },
      {
        "db": "VULMON",
        "id": "CVE-2021-31891"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-012333"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202109-931"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-78",
        "trust": 1.0
      },
      {
        "problemtype": "OS Command injection (CWE-78) [ others ]",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-012333"
      },
      {
        "db": "NVD",
        "id": "CVE-2021-31891"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.3,
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-535380.pdf"
      },
      {
        "trust": 1.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-31891"
      },
      {
        "trust": 0.8,
        "url": "https://jvn.jp/vu/jvnvu96712416/"
      },
      {
        "trust": 0.8,
        "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-257-18"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2021041363"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2021091605"
      },
      {
        "trust": 0.6,
        "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-257-18"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/78.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-535380.txt"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2021-71442"
      },
      {
        "db": "VULMON",
        "id": "CVE-2021-31891"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-012333"
      },
      {
        "db": "NVD",
        "id": "CVE-2021-31891"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-975"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202109-931"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "CNVD",
        "id": "CNVD-2021-71442"
      },
      {
        "db": "VULMON",
        "id": "CVE-2021-31891"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-012333"
      },
      {
        "db": "NVD",
        "id": "CVE-2021-31891"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-975"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202109-931"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2021-09-16T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2021-71442"
      },
      {
        "date": "2021-09-14T00:00:00",
        "db": "VULMON",
        "id": "CVE-2021-31891"
      },
      {
        "date": "2022-08-30T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2021-012333"
      },
      {
        "date": "2021-09-14T11:15:24.023000",
        "db": "NVD",
        "id": "CVE-2021-31891"
      },
      {
        "date": "2021-04-13T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202104-975"
      },
      {
        "date": "2021-09-14T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202109-931"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2022-01-18T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2021-71442"
      },
      {
        "date": "2021-09-28T00:00:00",
        "db": "VULMON",
        "id": "CVE-2021-31891"
      },
      {
        "date": "2022-08-30T02:02:00",
        "db": "JVNDB",
        "id": "JVNDB-2021-012333"
      },
      {
        "date": "2021-09-28T16:48:53.480000",
        "db": "NVD",
        "id": "CVE-2021-31891"
      },
      {
        "date": "2021-04-14T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202104-975"
      },
      {
        "date": "2022-07-01T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202109-931"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202109-931"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "in multiple Siemens products \u00a0OS\u00a0 Command injection vulnerability",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-012333"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "other",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-975"
      }
    ],
    "trust": 0.6
  }
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2021-31891 (GCVE-0-2021-31891)

Solution

Solution

Tags

Sightings

Nomenclature