CVE-2021-27395

A vulnerability has been identified in SIMATIC Process Historian 2013 and earlier (All versions), SIMATIC Process Historian 2014 (All versions < SP3 Update 6), SIMATIC Process Historian 2019 (All versions), SIMATIC Process Historian 2020 (All versions). An interface in the software that is used for critical functionalities lacks authentication, which could allow a malicious user to maliciously insert, modify or delete data.

CVSS v3 8.1 HIGH
CVSS v2.0 5.5 MEDIUM

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

5.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:N/I:P/A:P

Exploitability : 8.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://cert-portal.siemens.com/productcert/pdf/ssa-766247.pdf	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:siemens:simatic_process_historian_2013::::::::
	cpe:2.3:a:siemens:simatic_process_historian_2014:-:sp1::::::
	cpe:2.3:a:siemens:simatic_process_historian_2014:-:sp2::::::
	cpe:2.3:a:siemens:simatic_process_historian_2014:-:sp3::::::
	cpe:2.3:a:siemens:simatic_process_historian_2014:-:sp3_update4::::::
	cpe:2.3:a:siemens:simatic_process_historian_2019::::::::
	cpe:2.3:a:siemens:simatic_process_historian_2020::::::::

History

No history.

Information

Published : 2021-10-12 10:15

Updated : 2024-02-28 18:48

NVD link : CVE-2021-27395

Mitre link : CVE-2021-27395

CVE.ORG link : CVE-2021-27395

JSON object : View

Products Affected

siemens

simatic_process_historian_2013
simatic_process_historian_2020
simatic_process_historian_2019
simatic_process_historian_2014

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2021-27395", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "published": "2021-10-12T10:15:11.493", "references": [{"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-766247.pdf", "tags": ["Vendor Advisory"], "source": "productcert@siemens.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "productcert@siemens.com", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in SIMATIC Process Historian 2013 and earlier (All versions), SIMATIC Process Historian 2014 (All versions < SP3 Update 6), SIMATIC Process Historian 2019 (All versions), SIMATIC Process Historian 2020 (All versions). An interface in the software that is used for critical functionalities lacks authentication, which could allow a malicious user to maliciously insert, modify or delete data."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad en SIMATIC Process Historian 2013 y anteriores (Todas las versiones), SIMATIC Process Historian 2014 (Todas las versiones anteriores a SP3 Update 6), SIMATIC Process Historian 2019 (Todas las versiones), SIMATIC Process Historian 2020 (Todas las versiones). Una interfaz en el software que es usada para funcionalidades cr\u00edticas carece de autenticaci\u00f3n, lo que podr\u00eda permitir a un usuario malicioso insertar, modificar o eliminar datos de forma maliciosa"}], "lastModified": "2021-10-19T01:11:52.747", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:siemens:simatic_process_historian_2013:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "78883EE0-420B-49C6-B8C6-64915216504E"}, {"criteria": "cpe:2.3:a:siemens:simatic_process_historian_2014:-:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0D802BDB-8F9C-481E-A152-CAF4347C8B3B"}, {"criteria": "cpe:2.3:a:siemens:simatic_process_historian_2014:-:sp2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FEBF81AD-7354-4CD5-89A4-0088F6C00721"}, {"criteria": "cpe:2.3:a:siemens:simatic_process_historian_2014:-:sp3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DA9B2CB2-5D15-4470-9DBC-E168F12F3880"}, {"criteria": "cpe:2.3:a:siemens:simatic_process_historian_2014:-:sp3_update4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "98216800-858E-4C6E-B086-0F5E56888C9C"}, {"criteria": "cpe:2.3:a:siemens:simatic_process_historian_2019:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "81E1CC4F-602E-4DF8-9B4F-E52AF18C9B07"}, {"criteria": "cpe:2.3:a:siemens:simatic_process_historian_2020:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E89C6F2E-C7A9-4ACE-9247-4CE06BE90C53"}], "operator": "OR"}]}], "sourceIdentifier": "productcert@siemens.com"}