What is CVE-2021-37184?

CVE-2021-37184 is a critical-severity vulnerability in Siemens Industrial Edge Management, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 9.8/10. Published 2021-09-14.

How severe is CVE-2021-37184?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Auth bypass in Siemens Industrial Edge Management

CVE-2021-37184

A vulnerability has been identified in Industrial Edge Management (All versions < V1.3). An unauthenticated attacker could change the the password of any user in the system under certain circumstances. With this an attacker could impersonate any valid user on an affected system.

Vulnerability class: IDOR (Insecure Direct Object Reference)

EPSS: 0.010 (60.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Siemens Industrial Edge Management — versions All versions < V1.3
Siemens Industrial_edge_management

Weakness classification (CWE)

CWE-639 — Authorization Bypass Through User-Controlled Key

References

productcert@siemens.com (Patch, x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2021-37184?: CVE-2021-37184 is a critical-severity vulnerability in Siemens Industrial Edge Management, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 9.8/10. Published 2021-09-14.
How severe is CVE-2021-37184?: Critical severity. CVSS v3 base score is 9.8 out of 10.