CVE-2021-37172: High severity Siemens Simatic S7-1200 Cpu Firmware vulnerability
A vulnerability has been identified in SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (V4.5.0). Affected devices fail to authenticate against configured passwords when provisioned using TIA Portal V13. This could allow an attacker using TIA Portal V13 or later versions to bypass authentication and download arbitrary programs to the PLC. The vulnerability does not occur when TIA Portal V13 SP1 or any later version was used to provision the device.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SIMATIC S7-1200 CPU family (incl. SIPLUS variants)to a version that resolves this vulnerability.Fixed in V4.5.0
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2021-37172.
What is the severity of CVE-2021-37172?
The severity of CVE-2021-37172 is high with a CVSS score of 7.5.
Which devices are affected by CVE-2021-37172?
The SIMATIC S7-1200 CPU family (incl. SIPLUS variants) with firmware version 4.5.0 is affected.
How does CVE-2021-37172 impact the affected devices?
Affected devices fail to authenticate against configured passwords when provisioned using TIA Portal V13.
Is there a fix available for CVE-2021-37172?
Siemens has released a security advisory with recommended mitigations for CVE-2021-37172. Please refer to their official documentation for more details.