1. Home
  2. CVE Database
  3. CVE-2021-31337
CRITICAL · 9.8

CVE-2021-31337

The Telnet service of the SIMATIC HMI Comfort Panels system component in affected products does not require authentication, which may allow a remote attacker to gain access to the device if the servic...

Vulnerability Description

The Telnet service of the SIMATIC HMI Comfort Panels system component in affected products does not require authentication, which may allow a remote attacker to gain access to the device if the service is enabled. Telnet is disabled by default on the SINAMICS Medium Voltage Products (SINAMICS SL150: All versions, SINAMICS SM150: All versions, SINAMICS SM150i: All versions).

CVSS Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
SiemensSinamics Sl150 FirmwareAll versions
SiemensSinamics Sl150-
SiemensSinamics Sm150 FirmwareAll versions
SiemensSinamics Sm150-
SiemensSinamics Sm150I FirmwareAll versions
SiemensSinamics Sm150I-

Related Weaknesses (CWE)

CWE-306

References

FAQ

What is CVE-2021-31337?

CVE-2021-31337 is a vulnerability with a CVSS score of 9.8 (CRITICAL). The Telnet service of the SIMATIC HMI Comfort Panels system component in affected products does not require authentication, which may allow a remote attacker to gain access to the device if the servic...

How severe is CVE-2021-31337?

CVE-2021-31337 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2021-31337?

Check the references section above for vendor advisories and patch information. Affected products include: Siemens Sinamics Sl150 Firmware, Siemens Sinamics Sl150, Siemens Sinamics Sm150 Firmware, Siemens Sinamics Sm150, Siemens Sinamics Sm150I Firmware.