Incorrect permission assignment for critical resource in Siemens SIMATIC Software Products



Published: 2021-07-14
Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2021-31894
CWE-ID CWE-732
Exploitation vector Local
Public exploit N/A
Vulnerable software
Subscribe 		SIMATIC PCS 7
Server applications / SCADA systems

SIMATIC PDM
Server applications / SCADA systems

SIMATIC STEP 7
Server applications / SCADA systems

SINAMICS STARTER
Other software / Other software solutions

Vendor Siemens

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Incorrect permission assignment for critical resource

EUVDB-ID: #VU54870

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2021-31894

CWE-ID:

Exploit availability:

Description

The vulnerability allows a local user to compromise the target system.

The vulnerability exists due to incorrect permission assignment for critical resource. A local user can change the content of certain metafiles and subsequently manipulate parameters or the behavior of devices that would be later configured by the affected software.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

SIMATIC PCS 7: 8.2 - 9.0

SIMATIC PDM: All versions

SINAMICS STARTER: All versions

SIMATIC STEP 7: before 5.7

Fixed software versions

CPE2.3 External links

http://cert-portal.siemens.com/productcert/pdf/ssa-661034.pdf


Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?



###SIDEBAR###