1. Home
  2. CVE Database
  3. CVE-2021-37186
MEDIUM · 5.4

CVE-2021-37186

A vulnerability has been identified in LOGO! CMR2020 (All versions < V2.2), LOGO! CMR2040 (All versions < V2.2), SIMATIC RTU3010C (All versions < V4.0.9), SIMATIC RTU3030C (All versions < V4.0.9), SIM...

Vulnerability Description

A vulnerability has been identified in LOGO! CMR2020 (All versions < V2.2), LOGO! CMR2040 (All versions < V2.2), SIMATIC RTU3010C (All versions < V4.0.9), SIMATIC RTU3030C (All versions < V4.0.9), SIMATIC RTU3031C (All versions < V4.0.9), SIMATIC RTU3041C (All versions < V4.0.9). The underlying TCP/IP stack does not properly calculate the random numbers used as ISN (Initial Sequence Numbers). An adjacent attacker with network access to the LAN interface could interfere with traffic, spoof the connection and gain access to sensitive information.

CVSS Score

5.4

MEDIUM

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack Vector
ADJACENT_NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
SiemensLogo\! Cmr2020 Firmware< 2.2
SiemensLogo\! Cmr2020-
SiemensLogo\! Cmr2040 Firmware< 2.2
SiemensLogo\! Cmr2040-
SiemensSimatic Rtu3010C Firmware< 4.0.9
SiemensSimatic Rtu3010CAll versions
SiemensSimatic Rtu3030C Firmware< 4.0.9
SiemensSimatic Rtu3030CAll versions
SiemensSimatic Rtu3031C Firmware< 4.0.9
SiemensSimatic Rtu3031CAll versions
SiemensSimatic Rtu3041C Firmware< 4.0.9
SiemensSimatic Rtu3041CAll versions

Related Weaknesses (CWE)

CWE-330

References

FAQ

What is CVE-2021-37186?

CVE-2021-37186 is a vulnerability with a CVSS score of 5.4 (MEDIUM). A vulnerability has been identified in LOGO! CMR2020 (All versions < V2.2), LOGO! CMR2040 (All versions < V2.2), SIMATIC RTU3010C (All versions < V4.0.9), SIMATIC RTU3030C (All versions < V4.0.9), SIM...

How severe is CVE-2021-37186?

CVE-2021-37186 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-37186?

Check the references section above for vendor advisories and patch information. Affected products include: Siemens Logo\! Cmr2020 Firmware, Siemens Logo\! Cmr2020, Siemens Logo\! Cmr2040 Firmware, Siemens Logo\! Cmr2040, Siemens Simatic Rtu3010C Firmware.