What is CVE-2021-37172?

CVE-2021-37172 is a high-severity vulnerability in Siemens CPU 1211c, classified under Improper Authentication. CVSS score: 7.5/10. Published 2021-08-10.

How severe is CVE-2021-37172?

High severity. CVSS v3 base score is 7.5 out of 10.

Auth bypass in Siemens CPU 1211c

CVE-2021-37172

A vulnerability has been identified in SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (V4.5.0). Affected devices fail to authenticate against configured passwords when provisioned using TIA Portal V13. This could allow an attacker using TIA Portal V13 or later versions to bypass authentication and download arbitrary programs to the PLC. The vulnerability does not occur when TIA Portal V13 SP1 or any later version was used to provision the device.

Vulnerability class: Broken Authentication

EPSS: 0.009 (58.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.

Affected products

Siemens Cpu_1211c
Siemens Cpu_1212c
Siemens Cpu_1212fc
Siemens Cpu_1214c
Siemens Cpu_1214fc
Siemens Cpu_1215c
Siemens Cpu_1215fc
Siemens Cpu_1217c
Siemens Simatic S7-1200 Cpu Family (Incl. Siplus Variants) — versions V4.5.0
Siemens Simatic_s7-1200_cpu_firmware — versions 4.5.0

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

productcert@siemens.com (Patch, x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2021-37172?: CVE-2021-37172 is a high-severity vulnerability in Siemens CPU 1211c, classified under Improper Authentication. CVSS score: 7.5/10. Published 2021-08-10.
How severe is CVE-2021-37172?: High severity. CVSS v3 base score is 7.5 out of 10.