CVE-2021-27395

CWE-306 — Missing Authentication3 documents3 sources
Severity
8.1HIGH
EPSS
0.2%
top 51.96%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Siemens Simatic Process Historian 2013 AND EarlierSiemens Simatic Process Historian 2014Siemens Simatic Process Historian 2019+1 more
Timeline
PublishedOct 12
Latest updateMay 24

Description

A vulnerability has been identified in SIMATIC Process Historian 2013 and earlier (All versions), SIMATIC Process Historian 2014 (All versions < SP3 Update 6), SIMATIC Process Historian 2019 (All versions), SIMATIC Process Historian 2020 (All versions). An interface in the software that is used for critical functionalities lacks authentication, which could allow a malicious user to maliciously insert, modify or delete data.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:HExploitability: 2.8 | Impact: 5.2

Affected Packages4 packages

▶CVEListV5siemens/simatic_process_historian_2014All versions < SP3 Update 6

🔴Vulnerability Details

2
GHSA
GHSA-9j28-jmqh-8rph: A vulnerability has been identified in SIMATIC Process Historian 2013 and earlier (All versions), SIMATIC Process Historian 2014 (All versions < SP3 U↗2022-05-24
▶
CVEList
CVE-2021-27395: A vulnerability has been identified in SIMATIC Process Historian 2013 and earlier (All versions), SIMATIC Process Historian 2014 (All versions < SP3 U↗2021-10-12
▶