High severity · published Oct 12, 2021
CVE-2021-27395
A vulnerability has been identified in SIMATIC Process Historian 2013 and earlier (All versions), SIMATIC Process Historian 2014 (All versions < SP3 Update 6), SIMATIC Process…
8.1
CVSS
0.8%
EPSS
No
On KEV
Description
A vulnerability has been identified in SIMATIC Process Historian 2013 and earlier (All versions), SIMATIC Process Historian 2014 (All versions < SP3 Update 6), SIMATIC Process Historian 2019 (All versions), SIMATIC Process Historian 2020 (All versions). An interface in the software that is used for critical functionalities lacks authentication, which could allow a malicious user to maliciously insert, modify or delete data.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SP
Simatic Process Historian 2013 · Siemens
All versions, or not specified · source: NVD
SP
Simatic Process Historian 2014 · Siemens
All versions, or not specified · source: NVD
SP
Simatic Process Historian 2019 · Siemens
All versions, or not specified · source: NVD
SP
Simatic Process Historian 2020 · Siemens
All versions, or not specified · source: NVD