CVE-2021-45034
- State
- Published
- Severity
- Not scored
- Published
- Jan 11, 2022
- Updated
- Aug 4, 2024
- Reserved
- Dec 13, 2021
Description
A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions < V16.20), CP-8000 MASTER MODULE WITH I/O -40/+70°C (All versions < V16.20), CP-8021 MASTER MODULE (All versions < V16.20), CP-8022 MASTER MODULE WITH GPRS (All versions < V16.20). The web server of the affected system allows access to logfiles and diagnostic data generated by a privileged user. An unauthenticated attacker could access the files by knowing the corresponding download links.
Scores
The record has no CVSS score.
Weaknesses
- CWE-284 Improper Access Control
Affected Products
| Product | Versions |
|---|---|
CP-8000 MASTER MODULE WITH I/O -25/+70°CSiemens |
|
CP-8000 MASTER MODULE WITH I/O -40/+70°CSiemens |
|
CP-8021 MASTER MODULESiemens |
|
CP-8022 MASTER MODULE WITH GPRSSiemens |
|
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-324998.pdf
- 20220414 SEC Consult SA-20220413 :: Missing Authentication at File Download & Denial of Service in Siemens A8000 PLCmailing-list
- http://packetstormsecurity.com/files/166743/Siemens-A8000-CP-8050-CP-8031-SICAM-WEB-Missing-File-Download-Missing-Authentication.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.