VDB
CVE-2021-37172
CVE-2021-37172
PUBLISHED
CVSS 7.5 HIGH
A vulnerability has been identified in SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (V4.5.0). Affected devices fail to authenticate against configured passwords when provisioned using TIA Portal V13. This could allow an attacker using TIA Portal V17 or later versions to bypass authentication and download arbitrary programs to the PLC. The vulnerability does not occur when TIA Portal V13 SP1 or any later version was used to provision the device.
EPSS 0.19% · 40.3th percentile
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS Score
0.19%
40.3th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Siemens | SIMATIC S7-1200 CPU family (incl. SIPLUS variants) | V4.5.0 |
| siemens | simatic_s7-1200_cpu_firmware | 4.5.0 |
| siemens | simatic_step_7_\(tia_portal\) | 0 |
Timeline
- Apr 13, 2021 CVE Published
- Aug 11, 2021 EPSS Score
- Oct 9, 2021 EPSS Score
- Dec 6, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Feb 4, 2022 EPSS Score
- Apr 1, 2022 EPSS Score
- Apr 3, 2022 EPSS Score
- May 31, 2022 EPSS Score
- Jul 30, 2022 EPSS Score
- Sep 27, 2022 EPSS Score
- Nov 25, 2022 EPSS Score
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-309571.pdf advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-865327.pdf advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-365397.pdf advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-938030.pdf advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-679335.pdf advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-553445.pdf advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-158827.pdf advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-818688.pdf advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-756744.pdf advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-830194.pdf advisory
- https://nvd.nist.gov/vuln/detail/CVE-2021-37172 advisory