by Kastro
Paper/Archive/CVE-2021-44222

CVE-2021-44222

Siemens SIMATIC eaSie Core Package — A vulnerability has been identified in SIMATIC eaSie Core Package (All versions < V22.00).

EPSS 1%CVSS 9.1
critical.is priorityof 100
42
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 71.3.713 × 2014.3No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A vulnerability has been identified in SIMATIC eaSie Core Package (All versions < V22.00). The underlying MQTT service of affected systems does not perform authentication in the default configuration. This could allow an unauthenticated remote attacker to send arbitrary messages to the service and thereby issue arbitrary requests in the affected system.

Affected

ProductAffectedFixed inSource
SIMATIC eaSie Core PackageAll versions < V22.00–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

refcert-portal.siemens.com/productcert/pdf/ssa-580125.pdf