Auth bypass in Siemens Simatic Process Historian 2013
CVE-2021-27395
A vulnerability has been identified in SIMATIC Process Historian 2013 and earlier (All versions), SIMATIC Process Historian 2014 (All versions < SP3 Update 6), SIMATIC Process Historian 2019 (All versions), SIMATIC Process Historian 2020 (All versions). An interface in the software that is used for critical functionalities lacks authentication, which could allow a malicious user to maliciously insert, modify or delete data.
Vulnerability class: Broken Authentication
EPSS: 0.008 (54.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H.
Affected products
- Siemens Simatic_process_historian_2013
- Siemens Simatic Process Historian 2013 And Earlier — versions All versions
- Siemens Simatic Process Historian 2014 — versions All versions < SP3 Update 6
- Siemens Simatic_process_historian_2014
- Siemens Simatic Process Historian 2019 — versions All versions
- Siemens Simatic_process_historian_2019
- Siemens Simatic Process Historian 2020 — versions All versions
- Siemens Simatic_process_historian_2020
Weakness classification (CWE)
References
- productcert@siemens.com (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2021-27395?
- CVE-2021-27395 is a high-severity vulnerability in Siemens Simatic Process Historian 2013, classified under Missing Authentication for Critical Function. CVSS score: 8.1/10. Published 2021-10-12.
- How severe is CVE-2021-27395?
- High severity. CVSS v3 base score is 8.1 out of 10.