Main Vulnerability Database Vulnerabilities #VU57343

Missing Authentication for Critical Function in Siemens products - CVE-2021-27395

Published: October 13, 2021

Vulnerability identifier: #VU57343

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-27395

CWE-ID: CWE-306

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to the software that is used for critical functionalities lacks authentication. A remote attacker can maliciously insert, modify or delete data.

Affected software

SIMATIC Process Historian 2013
SIMATIC Process Historian 2019
SIMATIC Process Historian 2020
SIMATIC Process Historian 2014

How to mitigate CVE-2021-27395

Install updates from vendor's website.

SIMATIC Process Historian 2014 - update to SP3 Update 6

External References

https://cert-portal.siemens.com/productcert/pdf/ssa-766247.pdf

Related Security Bulletins

Missing Authentication for Critical Function in Siemens SIMATIC Process Historian