Login Request a demo
High severity · published Aug 10, 2021
CVE-2021-37172
A vulnerability has been identified in SIMATIC S7-1200 CPU family (incl
7.5
CVSS
0.9%
EPSS
No
On KEV
Description
A vulnerability has been identified in SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (V4.5.0). Affected devices fail to authenticate against configured passwords when provisioned using TIA Portal V13. This could allow an attacker using TIA Portal V13 or later versions to bypass authentication and download arbitrary programs to the PLC. The vulnerability does not occur when TIA Portal V13 SP1 or any later version was used to provision the device.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SS
Simatic S7-1200 Cpu Firmware · Siemens
4.5.0 · source: NVD
SS
Simatic Step 7 (tia Portal) · Siemens
through 13.0 · source: NVD
Affected product
SS
Simatic S7-1200 Cpu Firmware
Siemens
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-37172
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-37172
Patch
https://cert-portal.siemens.com/productcert/pdf/ssa-830194.pdf
More from Simatic S7-1200 Cpu Firmware
7.5
CVE-2023-28831
The OPC UA implementations (ANSI C and C++) in affected products contain an integer overflow vulnerability that could cause the application to run into an infinite loop during…
7.5
CVE-2019-10936
Affected devices improperly handle large amounts of specially crafted UDP packets
–
CVE-2015-5698
Cross-site request forgery (CSRF) vulnerability in the web server on Siemens SIMATIC S7-1200 CPU devices with firmware before 4.1.3 allows remote attackers to hijack the…
–
CVE-2015-1048
Open redirect vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices with firmware before 4.1 allows remote attackers to redirect users to arbitrary web…