high
7.4
CWE
295
Advisory Published
Updated

CVE-2021-31892

First published: Tue Jul 13 2021(Updated: )

A vulnerability has been identified in SINUMERIK Analyse MyCondition (All versions), SINUMERIK Analyze MyPerformance (All versions), SINUMERIK Analyze MyPerformance /OEE-Monitor (All versions), SINUMERIK Analyze MyPerformance /OEE-Tuning (All versions), SINUMERIK Integrate Client 02 (All versions >= V02.00.12 < 02.00.18), SINUMERIK Integrate Client 03 (All versions >= V03.00.12 < 03.00.18), SINUMERIK Integrate Client 04 (V04.00.02 and all versions >= V04.00.15 < 04.00.18), SINUMERIK Integrate for Production 4.1 (All versions < V4.1 SP10 HF3), SINUMERIK Integrate for Production 5.1 (V5.1), SINUMERIK Manage MyMachines (All versions), SINUMERIK Manage MyMachines /Remote (All versions), SINUMERIK Manage MyMachines /Spindel Monitor (All versions), SINUMERIK Manage MyPrograms (All versions), SINUMERIK Manage MyResources /Programs (All versions), SINUMERIK Manage MyResources /Tools (All versions), SINUMERIK Manage MyTools (All versions), SINUMERIK Operate V4.8 (All versions < V4.8 SP8), SINUMERIK Operate V4.93 (All versions < V4.93 HF7), SINUMERIK Operate V4.94 (All versions < V4.94 HF5), SINUMERIK Optimize MyProgramming /NX-Cam Editor (All versions). Due to an error in a third-party dependency the ssl flags used for setting up a TLS connection to a server are overwitten with wrong settings. This results in a missing validation of the server certificate and thus in a possible TLS MITM szenario.

Credit: productcert@siemens.com

Affected SoftwareAffected VersionHow to fix
Siemens Sinumerik Analyse Mycondition Firmware
Siemens Sinumerik Analyse Mycondition
Siemens Sinumerik Analyze Myperformance Firmware
Siemens Sinumerik Analyze Myperformance
Siemens Sinumerik Integrate Client Firmware>=2.00.12<2.00.18
Siemens Sinumerik Integrate Client Firmware>=3.00.12<3.00.18
Siemens Sinumerik Integrate Client Firmware>=4.00.15<4.00.18
Siemens Sinumerik Integrate Client
Siemens Sinumerik Integrate For Production Firmware<=4.1
Siemens Sinumerik Integrate For Production Firmware=5.1
Siemens Sinumerik Integrate For Production
Siemens Sinumerik Manage Mymachines Firmware
Siemens Sinumerik Manage Mymachines
Siemens Sinumerik Manage Myprograms Firmware
Siemens Sinumerik Manage Myprograms
Siemens Sinumerik Manage Myresources Firmware
Siemens Sinumerik Manage Myresources
Siemens Sinumerik Manage Mytools Firmware
Siemens Sinumerik Manage Mytools
Siemens Sinumerik Operate Firmware<4.8
Siemens Sinumerik Operate Firmware=4.8
Siemens Sinumerik Operate Firmware=4.8-sp1
Siemens Sinumerik Operate Firmware=4.8-sp2
Siemens Sinumerik Operate Firmware=4.8-sp3
Siemens Sinumerik Operate Firmware=4.8-sp4
Siemens Sinumerik Operate Firmware=4.8-sp5
Siemens Sinumerik Operate Firmware=4.8-sp6
Siemens Sinumerik Operate Firmware=4.8-sp7
Siemens Sinumerik Operate Firmware=4.93
Siemens Sinumerik Operate Firmware=4.93-hotfix_1
Siemens Sinumerik Operate Firmware=4.93-hotfix_2
Siemens Sinumerik Operate Firmware=4.93-hotfix_3
Siemens Sinumerik Operate Firmware=4.93-hotfix_4
Siemens Sinumerik Operate Firmware=4.93-hotfix_5
Siemens Sinumerik Operate Firmware=4.93-hotfix_6
Siemens Sinumerik Operate Firmware=4.94
Siemens Sinumerik Operate Firmware=4.94-hotfix_1
Siemens Sinumerik Operate Firmware=4.94-hotfix_2
Siemens Sinumerik Operate Firmware=4.94-hotfix_3
Siemens Sinumerik Operate Firmware=4.94-hotfix_4
Siemens Sinumerik Operate
Siemens Sinumerik Optimize Myprogramming Firmware
Siemens Sinumerik Optimize Myprogramming
: Siemens SINUMERIK Analyze MyCondition
: Siemens SINUMERIK Analyze MyPerformance
: Siemens SINUMERIK Analyze MyPerformance / OEE-Monitor
: Siemens SINUMERIK Analyze MyPerformance / OEE-Tuning
: Siemens SINUMERIK Integrate Client 02: All versions including v02.00.12 and up to but not including v02.00.18
: Siemens SINUMERIK Integrate Client 03: All versions between v03.00.12 and up to but not including v03.00.18
: Siemens SINUMERIK Integrate Client 04: Version v04.00.02 and all versions including v04.00.15 up to but not including v04.00.18
: Siemens SINUMERIK Integrate for Production 4.1 SP10 HF3<4.1
4.1
: Siemens SINUMERIK Integrate for Production 5.1=5.1
: Siemens SINUMERIK Manage MyMachines
: Siemens SINUMERIK Manage MyMachines / Remote
: Siemens SINUMERIK Manage MyMachines / Spindel Monitor
: Siemens SINUMERIK Manage MyPrograms
: Siemens SINUMERIK Manage MyResources / Programs
: Siemens SINUMERIK Manage MyResources / Tools
: Siemens SINUMERIK Manage My Tools
: Siemens SINUMERIK Operate v4.8 SP8<4.8
4.8
: Siemens SINUMERIK Operate v4.93 HF7<4.93
4.93
: Siemens SINUMERIK Operate v4.94 HF5<4.94
4.94
: Siemens SINUMERIK Optimize MyProgramming / NX-Cam Editor

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Parent vulnerabilities

(Appears in the following advisories)

Frequently Asked Questions

  • What is the vulnerability ID for this issue?

    The vulnerability ID for this issue is CVE-2021-31892.

  • What is the severity rating of CVE-2021-31892?

    CVE-2021-31892 has a severity rating of 7.4 (High).

  • Which software versions are affected by CVE-2021-31892?

    CVE-2021-31892 affects SINUMERIK Analyse MyCondition, SINUMERIK Analyze MyPerformance, SINUMERIK Analyze MyPerformance/OEE-Monitor, SINUMERIK Analyze MyPerformance/OEE-Tuning, and SINUMERIK Integrate Client versions >=2.00.12 and <4.00.18, >=3.00.12 and <4.00.18, and >=4.00.15 and <4.00.18.

  • How can I fix the vulnerability in SINUMERIK Analyze MyCondition software?

    To fix the vulnerability in SINUMERIK Analyze MyCondition firmware, update the software to a version that is not vulnerable.

  • Where can I find more information about CVE-2021-31892?

    You can find more information about CVE-2021-31892 at the following references: [Siemens ProductCERT Advisory](https://cert-portal.siemens.com/productcert/pdf/ssa-729965.pdf) and [US-CERT Advisory](https://us-cert.cisa.gov/ics/advisories/icsa-21-194-04).

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203