CVE-2021-40359

siemens simatic batch, siemens simatic net pc, siemens simatic route control +2 lainnya

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2021-40359

Katalog CVE

CVSS 7.7 · High EPSS 1,2%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada siemens simatic batch, siemens simatic net pc +3 lainnya. Skor CVSS 3.1 7.7 (High) menurut siemens.com.

Deskripsi (NVD)

A vulnerability has been identified in OpenPCS 7 V8.2 (All versions), OpenPCS 7 V9.0 (All versions < V9.0 Upd4), OpenPCS 7 V9.1 (All versions), SIMATIC BATCH V8.2 (All versions), SIMATIC BATCH V9.0 (All versions), SIMATIC BATCH V9.1 (All versions), SIMATIC NET PC Software V14 (All versions), SIMATIC NET PC Software V15 (All versions), SIMATIC NET PC Software V16 (All versions < V16 Update 6), SIMATIC NET PC Software V17 (All versions < V17 SP1), SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC04), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMATIC Route Control V8.2 (All versions), SIMATIC Route Control V9.0 (All versions), SIMATIC Route Control V9.1 (All versions), SIMATIC WinCC V15 and earlier (All versions < V15 SP1 Update 7), SIMATIC WinCC V16 (All versions < V16 Update 5), SIMATIC WinCC V17 (All versions < V17 Update 2), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 19), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 5). When downloading files, the affected systems do not properly neutralize special elements within the pathname. An attacker could then cause the pathname to resolve to a location outside of the restricted directory on the server and read unexpected critical files.

Rincian

Terbit di NVD
9 November 2021
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
7.7 (High), sumber siemens.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
EPSS (30 hari)
1,2% peluang dieksploitasi; lebih tinggi dari 66,7% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
siemens simatic batch Versi 8.2
siemens simatic batch Versi 8.2 upd_9
siemens simatic batch Versi 9.0
siemens simatic batch Versi 9.0 sp1
siemens simatic batch Versi 9.0 sp1_update_1
siemens simatic batch Versi 9.0 sp1_update_2
siemens simatic batch Versi 9.0 sp1_update_3
siemens simatic batch Versi 9.0 sp1_update_4
siemens simatic batch Versi 9.1
siemens simatic net pc Versi 14
siemens simatic net pc Versi 15
siemens simatic net pc Versi 16
siemens simatic net pc Versi 16 update1
siemens simatic net pc Versi 17
siemens simatic route control Versi 8.2
siemens simatic route control Versi 9.0
siemens simatic route control Versi 9.1
siemens simatic wincc Semua versi hingga 7.4
siemens simatic wincc Versi 7.5
siemens simatic wincc Versi 7.5 sp1
siemens simatic wincc Versi 7.5 sp1_update1
siemens simatic wincc Versi 7.5 sp1_update2
siemens simatic wincc Versi 7.5 sp2
siemens simatic wincc Versi 7.5 sp2_update1
siemens simatic wincc Versi 7.5 sp2_update2
siemens simatic wincc Versi 7.5 sp2_update3
siemens simatic wincc Versi 7.5 sp2_update4
siemens simatic wincc Versi 15
siemens simatic wincc Versi 16
siemens simatic wincc Versi 16 update1
siemens simatic wincc Versi 16 update2
siemens simatic wincc Versi 16 update3
siemens simatic wincc Versi 16 update4
siemens simatic wincc Versi 17
siemens simatic wincc Versi 17 update1
siemens simaticpcs 7 Semua versi hingga 8.2
siemens simaticpcs 7 Versi 9.0 hingga sebelum 9.1
siemens simaticpcs 7 Versi 9.1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.