Siemens SIPROTEC 5 6MD85 devices (CPU variant CP300)

CVE-2021-41769
HIGH 7.5

At a glance

Source
NVD
EPSS
EPSS 0.97 % · percentile 62 ()
State
PUBLISHED
Published
Updated
Assigner
siemens
NVD status
Modified

Description

A vulnerability has been identified in SIPROTEC 5 6MD85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 6MD86 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 6MD89 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 6MU85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7KE85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SA82 devices (CPU variant CP100) (All versions < V8.83), SIPROTEC 5 7SA86 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SA87 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SD82 devices (CPU variant CP100) (All versions < V8.83), SIPROTEC 5 7SD86 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SD87 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SJ81 devices (CPU variant CP100) (All versions < V8.83), SIPROTEC 5 7SJ82 devices (CPU variant CP100) (All versions < V8.83), SIPROTEC 5 7SJ85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SJ86 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SK82 devices (CPU variant CP100) (All versions < V8.83), SIPROTEC 5 7SK85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SL82 devices (CPU variant CP100) (All versions < V8.83), SIPROTEC 5 7SL86 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SL87 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SS85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7ST85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SX85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7UM85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7UT82 devices (CPU variant CP100) (All versions < V8.83), SIPROTEC 5 7UT85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7UT86 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7UT87 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7VE85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7VK87 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 Compact 7SX800 devices (CPU variant CP050) (All versions < V8.83). An improper input validation vulnerability in the web server could allow an unauthenticated user to access device information.

Weaknesses (CWE)

  • CWE-20 — Improper Input Validation

References

Scores

VersionScoreVectorScored by
CVSS 3.1HIGH 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NNVD · nvd@nist.gov (Primary)
CVSS 2.0MEDIUM 5.0AV:N/AC:L/Au:N/C:P/I:N/A:NNVD · nvd@nist.gov (Primary)

European references

CERT-FR advisories

Affected configurations (NVD CPE)

Affected products

ProductVersions
Siemens · SIPROTEC 5 6MD85 devices (CPU variant CP300)affected All versions < V8.83
Siemens · SIPROTEC 5 6MD86 devices (CPU variant CP300)affected All versions < V8.83
Siemens · SIPROTEC 5 6MD89 devices (CPU variant CP300)affected All versions < V8.83
Siemens · SIPROTEC 5 6MU85 devices (CPU variant CP300)affected All versions < V8.83
Siemens · SIPROTEC 5 7KE85 devices (CPU variant CP300)affected All versions < V8.83
Siemens · SIPROTEC 5 7SA82 devices (CPU variant CP100)affected All versions < V8.83
Siemens · SIPROTEC 5 7SA86 devices (CPU variant CP300)affected All versions < V8.83
Siemens · SIPROTEC 5 7SA87 devices (CPU variant CP300)affected All versions < V8.83
Siemens · SIPROTEC 5 7SD82 devices (CPU variant CP100)affected All versions < V8.83
Siemens · SIPROTEC 5 7SD86 devices (CPU variant CP300)affected All versions < V8.83
Siemens · SIPROTEC 5 7SD87 devices (CPU variant CP300)affected All versions < V8.83
Siemens · SIPROTEC 5 7SJ81 devices (CPU variant CP100)affected All versions < V8.83
Siemens · SIPROTEC 5 7SJ82 devices (CPU variant CP100)affected All versions < V8.83
Siemens · SIPROTEC 5 7SJ85 devices (CPU variant CP300)affected All versions < V8.83
Siemens · SIPROTEC 5 7SJ86 devices (CPU variant CP300)affected All versions < V8.83
Siemens · SIPROTEC 5 7SK82 devices (CPU variant CP100)affected All versions < V8.83
Siemens · SIPROTEC 5 7SK85 devices (CPU variant CP300)affected All versions < V8.83
Siemens · SIPROTEC 5 7SL82 devices (CPU variant CP100)affected All versions < V8.83
Siemens · SIPROTEC 5 7SL86 devices (CPU variant CP300)affected All versions < V8.83
Siemens · SIPROTEC 5 7SL87 devices (CPU variant CP300)affected All versions < V8.83

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD