by Kastro
Paper/Archive/CVE-2021-31891

CVE-2021-31891

Siemens Desigo CC — A vulnerability has been identified in Desigo CC (All versions with OIS Extension Module), GMA-Manager (All versions with OIS running on…

EPSS 4%CVSS 10.0
critical.is priorityof 100
48
CVSS 10.0 (NVD)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 90.1.901 × 2018.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A vulnerability has been identified in Desigo CC (All versions with OIS Extension Module), GMA-Manager (All versions with OIS running on Debian 9 or earlier), Operation Scheduler (All versions with OIS running on Debian 9 or earlier), Siveillance Control (All versions with OIS running on Debian 9 or earlier), Siveillance Control Pro (All versions). The affected application incorrectly neutralizes special elements in a specific HTTP GET request which could lead to command injection. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary code on the system with root privileges.

Affected

ProductAffectedFixed inSource
Desigo CCAll versions with OIS Extension Module–CNA
GMA-ManagerAll versions with OIS running on Debian 9 or earlier–CNA
Operation SchedulerAll versions with OIS running on Debian 9 or earlier–CNA
Siveillance ControlAll versions with OIS running on Debian 9 or earlier–CNA
Siveillance Control ProAll versions–CNA

Scores by source

NVD10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

refcert-portal.siemens.com/productcert/pdf/ssa-535380.pdf