CVE-2021-40358

siemens simatic pcs 7, siemens simatic wincc

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2021-40358

Katalog CVE

CVSS 9.9 · Critical EPSS 1,3%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada siemens simatic pcs 7, siemens simatic wincc. Skor CVSS 3.1 9.9 (Critical) menurut siemens.com.

Deskripsi (NVD)

A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC04), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMATIC WinCC V15 and earlier (All versions < V15 SP1 Update 7), SIMATIC WinCC V16 (All versions < V16 Update 5), SIMATIC WinCC V17 (All versions < V17 Update 2), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 19), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 5). Legitimate file operations on the web server of the affected systems do not properly neutralize special elements within the pathname. An attacker could then cause the pathname to resolve to a location outside of the restricted directory on the server and read, write or delete unexpected critical files.

Rincian

Terbit di NVD
9 November 2021
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
9.9 (Critical), sumber siemens.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
EPSS (30 hari)
1,3% peluang dieksploitasi; lebih tinggi dari 69,1% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
siemens simatic pcs 7 Versi 8.2
siemens simatic pcs 7 Versi 9.0
siemens simatic pcs 7 Versi 9.1
siemens simatic wincc Versi 7.4
siemens simatic wincc Versi 7.4 sp1
siemens simatic wincc Versi 7.4 sp1_update1
siemens simatic wincc Versi 7.4 sp1_update10
siemens simatic wincc Versi 7.4 sp1_update11
siemens simatic wincc Versi 7.4 sp1_update12
siemens simatic wincc Versi 7.4 sp1_update13
siemens simatic wincc Versi 7.4 sp1_update14
siemens simatic wincc Versi 7.4 sp1_update15
siemens simatic wincc Versi 7.4 sp1_update16
siemens simatic wincc Versi 7.4 sp1_update17
siemens simatic wincc Versi 7.4 sp1_update18
siemens simatic wincc Versi 7.4 sp1_update2
siemens simatic wincc Versi 7.4 sp1_update3
siemens simatic wincc Versi 7.4 sp1_update4
siemens simatic wincc Versi 7.4 sp1_update5
siemens simatic wincc Versi 7.4 sp1_update6
siemens simatic wincc Versi 7.4 sp1_update7
siemens simatic wincc Versi 7.4 sp1_update8
siemens simatic wincc Versi 7.4 sp1_update9
siemens simatic wincc Versi 7.4 update_1
siemens simatic wincc Versi 7.5
siemens simatic wincc Versi 7.5 sp1
siemens simatic wincc Versi 7.5 sp1_update1
siemens simatic wincc Versi 7.5 sp1_update2
siemens simatic wincc Versi 7.5 sp2
siemens simatic wincc Versi 7.5 sp2_update1
siemens simatic wincc Versi 7.5 sp2_update2
siemens simatic wincc Versi 7.5 sp2_update3
siemens simatic wincc Versi 7.5 sp2_update4
siemens simatic wincc Versi 15
siemens simatic wincc Versi 15.1
siemens simatic wincc Versi 15.1 update_1
siemens simatic wincc Versi 15.1 update_2
siemens simatic wincc Versi 15.1 update_3
siemens simatic wincc Versi 15.1 update_4
siemens simatic wincc Versi 15.1 update_5
siemens simatic wincc Versi 15.1 update_6
siemens simatic wincc Versi 16 update1
siemens simatic wincc Versi 16 update2
siemens simatic wincc Versi 16 update3
siemens simatic wincc Versi 16 update4
siemens simatic wincc Versi 17
siemens simatic wincc Versi 17 update1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.