Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2021-42022

Quick assessment

Affected
Siemens SIMATIC eaSie PCS 7 Skill Package
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Siemens SIMATIC是西门子（Siemens）的一款组态软件。 Siemens SIMATIC PCS 7 存在路径遍历漏洞，该漏洞源于下载文件时，受影响的系统无法正确消除路径名中的特殊元素。 然后，攻击者可能会导致路径名解析到服务器上受限目录之外的位置，并读取意外的关键文件。 受影响的文件下载功能默认关闭。

AI Predicted 6.5 Difficulty: Easy EPSS 0.91% · P57

Possible ATT&CK Techniques 1 AI

T1083 · File and Directory Discovery
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2021-42022

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability has been identified in SIMATIC eaSie PCS 7 Skill Package (All versions < V21.00 SP3). When downloading files, the affected systems do not properly neutralize special elements within the pathname. An attacker could then cause the pathname to resolve to a location outside of the restricted directory on the server and read unexpected critical files. The affected file download function is disabled by default.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Vulnerability Title
Siemens SIMATIC PCS 7 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Siemens SIMATIC是西门子（Siemens）的一款组态软件。 Siemens SIMATIC PCS 7 存在路径遍历漏洞，该漏洞源于下载文件时，受影响的系统无法正确消除路径名中的特殊元素。 然后，攻击者可能会导致路径名解析到服务器上受限目录之外的位置，并读取意外的关键文件。 受影响的文件下载功能默认关闭。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Siemens SIMATIC eaSie PCS 7 Skill Package All versions < V21.00 SP3 -

II. Public POCs for CVE-2021-42022

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2021-42022

请登录查看更多情报信息。

Vendor Advisories for CVE-2021-42022 (1)

Same Patch Batch · Siemens · 2021-12-14 · 46 CVEs total

CVE-2021-44002 7.8 HIGH Siemens JT2GO和Siemens Teamcenter Visualization 缓冲区错误漏洞
CVE-2021-44014 7.8 HIGH Siemens JT2GO 资源管理错误漏洞
CVE-2021-44440 Siemens JT Utilities 缓冲区错误漏洞
CVE-2021-44446 Siemens JT Utilities 缓冲区错误漏洞
CVE-2021-44449 Siemens JT Utilities 缓冲区错误漏洞
CVE-2021-44450 Siemens JT Utilities 缓冲区错误漏洞
CVE-2021-44522 Siemens SiPass Integrated和Siveillance Identity 安全漏洞
CVE-2021-44523 Siemens SiPass Integrated和Siveillance Identity 安全漏洞
CVE-2021-44524 Siemens SiPass Integrated和Siveillance Identity 授权问题漏洞
CVE-2021-44448 Siemens JT Utilities 缓冲区错误漏洞
CVE-2021-44442 Siemens JT Utilities 安全漏洞
CVE-2021-44441 Siemens JT Utilities 缓冲区错误漏洞
CVE-2021-44443 Siemens JT Utilities 缓冲区错误漏洞
CVE-2021-44439 Siemens JT Utilities 缓冲区错误漏洞
CVE-2021-44438 Siemens JT Utilities 缓冲区错误漏洞
CVE-2021-44437 Siemens JT Utilities 缓冲区错误漏洞
CVE-2021-44436 Siemens JT Utilities 缓冲区错误漏洞
CVE-2021-44435 Siemens JT Utilities 缓冲区错误漏洞
CVE-2021-44434 Siemens JT Utilities 缓冲区错误漏洞
CVE-2021-44433 Siemens JT Utilities 资源管理错误漏洞

Showing top 20 of 46 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same vendor: Siemens
Same weakness: CWE-22

V. Comments for CVE-2021-42022

No comments yet

Leave a comment