CVE-2021-45034

Katalog CVE

CVSS 7.5 · High EPSS 2,3%

Kerentanan Improper Access Control pada siemens cp-8000 master module with i/o -25/+70 firmware, siemens cp-8000 master module with i/o -40/+70 firmware +2 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions < V16.20), CP-8000 MASTER MODULE WITH I/O -40/+70°C (All versions < V16.20), CP-8021 MASTER MODULE (All versions < V16.20), CP-8022 MASTER MODULE WITH GPRS (All versions < V16.20). The web server of the affected system allows access to logfiles and diagnostic data generated by a privileged user. An unauthenticated attacker could access the files by knowing the corresponding download links.

Rincian

Terbit di NVD

11 Januari 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control
CWE-532: Insertion of Sensitive Information into Log File

EPSS (30 hari)

2,3% peluang dieksploitasi; lebih tinggi dari 82,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://cert-portal.siemens.com/productcert/pdf/ssa-324998.pdf patch · advisory vendor
• http://packetstormsecurity.com/files/166743/Siemens-A8000-CP-8050-CP-8031-SICAM-WEB-Missing-File-Download-Miss... exploit · advisory pihak ketiga · vdb entry
• http://seclists.org/fulldisclosure/2022/Apr/20 exploit · mailing list · advisory pihak ketiga