Vulnerability Description
A vulnerability has been identified in Desigo CC (All versions with OIS Extension Module), GMA-Manager (All versions with OIS running on Debian 9 or earlier), Operation Scheduler (All versions with OIS running on Debian 9 or earlier), Siveillance Control (All versions with OIS running on Debian 9 or earlier), Siveillance Control Pro (All versions). The affected application incorrectly neutralizes special elements in a specific HTTP GET request which could lead to command injection. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary code on the system with root privileges.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Siemens | Desigo Cc | All versions |
| Siemens | Siveillance Control Pro | All versions |
| Siemens | Gma-Manager | All versions |
| Siemens | Operation Scheduler | All versions |
| Siemens | Siveillance Control | All versions |
| Debian | Debian Linux | <= 9.0 |
Related Weaknesses (CWE)
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-535380.pdfPatchVendor Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-535380.pdfPatchVendor Advisory
FAQ
What is CVE-2021-31891?
CVE-2021-31891 is a vulnerability with a CVSS score of 10.0 (CRITICAL). A vulnerability has been identified in Desigo CC (All versions with OIS Extension Module), GMA-Manager (All versions with OIS running on Debian 9 or earlier), Operation Scheduler (All versions with OI...
How severe is CVE-2021-31891?
CVE-2021-31891 has been rated CRITICAL with a CVSS base score of 10.0/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2021-31891?
Check the references section above for vendor advisories and patch information. Affected products include: Siemens Desigo Cc, Siemens Siveillance Control Pro, Siemens Gma-Manager, Siemens Operation Scheduler, Siemens Siveillance Control.