Siemens SIMATIC Process Historian 2013 and earlier
At a glance
- Source
- NVD
- EPSS
- EPSS 0.80 % · percentile 57 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- siemens
- NVD status
- Modified
Description
A vulnerability has been identified in SIMATIC Process Historian 2013 and earlier (All versions), SIMATIC Process Historian 2014 (All versions < SP3 Update 6), SIMATIC Process Historian 2019 (All versions), SIMATIC Process Historian 2020 (All versions). An interface in the software that is used for critical functionalities lacks authentication, which could allow a malicious user to maliciously insert, modify or delete data.
Weaknesses (CWE)
- CWE-306 — Missing Authentication for Critical Functionality
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 5.5 | AV:N/AC:L/Au:S/C:N/I:P/A:P | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2021-14150
- GCVE · GCVE-0-2021-27395
CERT-FR advisories
- CERTFR-2021-AVI-774 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:siemens:simatic_process_historian_2013:*:*:*:*:*:*:*:*cpe:2.3:a:siemens:simatic_process_historian_2014:-:sp1:*:*:*:*:*:*cpe:2.3:a:siemens:simatic_process_historian_2014:-:sp2:*:*:*:*:*:*cpe:2.3:a:siemens:simatic_process_historian_2014:-:sp3:*:*:*:*:*:*cpe:2.3:a:siemens:simatic_process_historian_2014:-:sp3_update4:*:*:*:*:*:*cpe:2.3:a:siemens:simatic_process_historian_2019:*:*:*:*:*:*:*:*cpe:2.3:a:siemens:simatic_process_historian_2020:*:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Siemens · SIMATIC Process Historian 2013 and earlier | affected All versions |
| Siemens · SIMATIC Process Historian 2014 | affected All versions < SP3 Update 6 |
| Siemens · SIMATIC Process Historian 2019 | affected All versions |
| Siemens · SIMATIC Process Historian 2020 | affected All versions |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |