Path traversal in Siemens products - CVE-2021-42021

Vulnerability identifier: #VU58195

CSH Severity: High

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-42021

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.

Siveillance Video DLNA Server 2019 R1
Siveillance Video DLNA Server 2019 R2
Siveillance Video DLNA Server 2019 R3
Siveillance Video DLNA Server 2020 R1
Siveillance Video DLNA Server 2020 R2
Siveillance Video DLNA Server 2020 R3
Siveillance Video DLNA Server 2021 R1

Install update from vendor's website.

• https://cert-portal.siemens.com/productcert/pdf/ssa-755517.pdf

• Path traversal in Siemens Siveillance Video DLNA Server