Multiple vulnerabilities in Siemens Software Center
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 2 |
| CVE-ID | CVE-2021-41544 CVE-2022-25634 |
| CWE-ID | CWE-427 CWE-22 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
Software Center Other software / Other software solutions |
| Vendor | Siemens |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
1) Insecure DLL loading
EUVDB-ID: #VU79309
Risk: Low
CVSSv3.1:
CVE-ID: CVE-2021-41544
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows a local user to compromise vulnerable system.
The vulnerability exists due to the application loads DLL libraries in an insecure manner. A local user can place a specially crafted .dll file and execute arbitrary code on the target system with elevated privileges.
MitigationInstall update from vendor's website.
Vulnerable software versionsSoftware Center: before 3.0
Fixed software versionsCPE2.3 External links
http://cert-portal.siemens.com/productcert/txt/ssa-188491.txt
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
2) Path traversal
EUVDB-ID: #VU79310
Risk: Medium
CVSSv3.1:
CVE-ID: CVE-2022-25634
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.
MitigationInstall update from vendor's website.
Vulnerable software versionsSoftware Center: before 3.0
Fixed software versionsCPE2.3 External links
http://cert-portal.siemens.com/productcert/txt/ssa-188491.txt
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
