CVE-2021-31892

siemens sinumerik analyse mycondition firmware, siemens sinumerik analyze myperformance firmware, siemens sinumerik integrate client firmware +7 lainnya

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2021-31892

Katalog CVE

CVSS 7.4 · High EPSS 0,49%

Kerentanan Improper Certificate Validation pada siemens sinumerik analyse mycondition firmware, siemens sinumerik analyze myperformance firmware +8 lainnya. Skor CVSS 3.1 7.4 (High) menurut NVD.

Deskripsi (NVD)

A vulnerability has been identified in SINUMERIK Analyse MyCondition (All versions), SINUMERIK Analyze MyPerformance (All versions), SINUMERIK Analyze MyPerformance /OEE-Monitor (All versions), SINUMERIK Analyze MyPerformance /OEE-Tuning (All versions), SINUMERIK Integrate Client 02 (All versions >= V02.00.12 < 02.00.18), SINUMERIK Integrate Client 03 (All versions >= V03.00.12 < 03.00.18), SINUMERIK Integrate Client 04 (V04.00.02 and all versions >= V04.00.15 < 04.00.18), SINUMERIK Integrate for Production 4.1 (All versions < V4.1 SP10 HF3), SINUMERIK Integrate for Production 5.1 (V5.1), SINUMERIK Manage MyMachines (All versions), SINUMERIK Manage MyMachines /Remote (All versions), SINUMERIK Manage MyMachines /Spindel Monitor (All versions), SINUMERIK Manage MyPrograms (All versions), SINUMERIK Manage MyResources /Programs (All versions), SINUMERIK Manage MyResources /Tools (All versions), SINUMERIK Manage MyTools (All versions), SINUMERIK Operate V4.8 (All versions < V4.8 SP8), SINUMERIK Operate V4.93 (All versions < V4.93 HF7), SINUMERIK Operate V4.94 (All versions < V4.94 HF5), SINUMERIK Optimize MyProgramming /NX-Cam Editor (All versions). Due to an error in a third-party dependency the ssl flags used for setting up a TLS connection to a server are overwitten with wrong settings. This results in a missing validation of the server certificate and thus in a possible TLS MITM szenario.

Rincian

Terbit di NVD
13 Juli 2021
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
7.4 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-295: Improper Certificate Validation
EPSS (30 hari)
0,49% peluang dieksploitasi; lebih tinggi dari 40,1% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
siemens sinumerik analyse mycondition firmware Semua versi
siemens sinumerik analyze myperformance firmware Semua versi
siemens sinumerik integrate client firmware Versi 2.00.12 hingga sebelum 2.00.18
siemens sinumerik integrate client firmware Versi 3.00.12 hingga sebelum 3.00.18
siemens sinumerik integrate client firmware Versi 4.00.15 hingga sebelum 4.00.18
siemens sinumerik integrate for production firmware Semua versi hingga 4.1
siemens sinumerik integrate for production firmware Versi 5.1
siemens sinumerik manage mymachines firmware Semua versi
siemens sinumerik manage myprograms firmware Semua versi
siemens sinumerik manage myresources firmware Semua versi
siemens sinumerik manage mytools firmware Semua versi
siemens sinumerik operate firmware Semua versi sebelum 4.8
siemens sinumerik operate firmware Versi 4.8
siemens sinumerik operate firmware Versi 4.8 sp1
siemens sinumerik operate firmware Versi 4.8 sp2
siemens sinumerik operate firmware Versi 4.8 sp3
siemens sinumerik operate firmware Versi 4.8 sp4
siemens sinumerik operate firmware Versi 4.8 sp5
siemens sinumerik operate firmware Versi 4.8 sp6
siemens sinumerik operate firmware Versi 4.8 sp7
siemens sinumerik operate firmware Versi 4.93
siemens sinumerik operate firmware Versi 4.93 hotfix_1
siemens sinumerik operate firmware Versi 4.93 hotfix_2
siemens sinumerik operate firmware Versi 4.93 hotfix_3
siemens sinumerik operate firmware Versi 4.93 hotfix_4
siemens sinumerik operate firmware Versi 4.93 hotfix_5
siemens sinumerik operate firmware Versi 4.93 hotfix_6
siemens sinumerik operate firmware Versi 4.94
siemens sinumerik operate firmware Versi 4.94 hotfix_1
siemens sinumerik operate firmware Versi 4.94 hotfix_2
siemens sinumerik operate firmware Versi 4.94 hotfix_3
siemens sinumerik operate firmware Versi 4.94 hotfix_4
siemens sinumerik optimize myprogramming firmware Semua versi

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.