CVE-2021-40360: Infoleak
A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMATIC WinCC V15 and earlier (All versions < V15 SP1 Update 7), SIMATIC WinCC V16 (All versions < V16 Update 5), SIMATIC WinCC V17 (All versions < V17 Update 2), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 19), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 6). The password hash of a local user account in the remote server could be granted via public API to a user on the affected system. An authenticated attacker could brute force the password hash and use it to login to the server.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2021-40360?
The severity of CVE-2021-40360 is high with a CVSS score of 8.8.
Which versions of SIMATIC PCS 7 are affected by CVE-2021-40360?
SIMATIC PCS 7 V8.2, SIMATIC PCS 7 V9.0, and SIMATIC PCS 7 V9.1 (before V9.1 SP1) are affected by CVE-2021-40360.
Which versions of SIMATIC WinCC are affected by CVE-2021-40360?
SIMATIC WinCC V15 and earlier versions (before V15 SP1 Update 7), SIMATIC WinCC V16 (before Update 5), and SIMATIC WinCC V17 are affected by CVE-2021-40360.
How can I fix CVE-2021-40360?
To fix CVE-2021-40360, apply the latest security update or patch provided by Siemens.
Where can I find more information about CVE-2021-40360?
You can find more information about CVE-2021-40360 in the Siemens ProductCERT advisory: [Link](https://cert-portal.siemens.com/productcert/pdf/ssa-914168.pdf).