CVE-2021-33737 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Siemens Simatic CP 343-1

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer3 documents3 sources
Severity
7.5HIGHNVD
EPSS
0.2%
top 54.32%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
8
Siemens Simatic CP 343-1Siemens Simatic CP 343-1 AdvancedSiemens Simatic CP 343-1 Erpc+5 more
Timeline
PublishedSep 14
Latest updateMay 24

Description

A vulnerability has been identified in SIMATIC CP 343-1 (incl. SIPLUS variants) (All versions), SIMATIC CP 343-1 Advanced (incl. SIPLUS variants) (All versions), SIMATIC CP 343-1 ERPC (All versions), SIMATIC CP 343-1 Lean (incl. SIPLUS variants) (All versions), SIMATIC CP 443-1 (All versions < V3.3), SIMATIC CP 443-1 (All versions < V3.3), SIMATIC CP 443-1 Advanced (All versions < V3.3), SIPLUS NET CP 443-1 (All versions < V3.3), SIPLUS NET CP 443-1 Advanced (All versions < V3.3). Sending a spec…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages8 packages

▶CVEListV5siemens/simatic_cp_343-1_advancedAll versions
▶CVEListV5siemens/simatic_cp_443-1_advancedAll versions < V3.3
▶CVEListV5siemens/simatic_cp_343-1_erpcAll versions
▶CVEListV5siemens/simatic_cp_343-1_leanAll versions
▶CVEListV5siemens/siplus_net_cp_443-1_advancedAll versions < V3.3

Patches

Patch: cert-portal.siemens.com ↗Patch: cert-portal.siemens.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-w34c-jjqq-3824: A vulnerability has been identified in SIMATIC CP 343-1 (incl↗2022-05-24
▶
CVEList
CVE-2021-33737: A vulnerability has been identified in SIMATIC CP 343-1 (incl↗2021-09-14
▶
CVE-2021-33737 — Siemens Simatic CP 343-1 vulnerability | cvebase