fkie_cve-2021-46304
Vulnerability from fkie_nvd
Published
2022-08-10 12:15
Modified
2024-11-21 06:33
Severity ?
Summary
A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions), CP-8000 MASTER MODULE WITH I/O -40/+70°C (All versions), CP-8021 MASTER MODULE (All versions), CP-8022 MASTER MODULE WITH GPRS (All versions). The component allows to activate a web server module which provides unauthenticated access to its web pages. This could allow an attacker to retrieve debug-level information from the component such as internal network topology or connected systems.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:siemens:cp-8021_master_module_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "FE530A72-33F3-48B5-8F10-1B093762C8AE",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:siemens:cp-8021_master_module:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0F257456-CB80-485A-94B7-B996D388D38D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:siemens:cp-8000_master_module_with_i\\/o_-25\\/\\+70_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8EFF2EB1-B4D1-4A81-8453-BCAA221E693A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:siemens:cp-8000_master_module_with_i\\/o_-25\\/\\+70:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5BC48F66-67A4-4788-B9AC-8C1E682375DF",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:siemens:cp-8000_master_module_with_i\\/o_-40\\/\\+70_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "78987EEB-1919-4E9F-A011-364B6D815C2D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:siemens:cp-8000_master_module_with_i\\/o_-40\\/\\+70:-:*:*:*:*:*:*:*",
"matchCriteriaId": "218B8555-E36A-4149-91D4-CF56DE6EFD4C",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:siemens:cp-8022_master_module_with_gprs_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "88907B10-5555-465C-A048-791E80EC2F35",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:siemens:cp-8022_master_module_with_gprs:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6807A5B6-F103-460A-83FD-7D7C7AA25D71",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70\u00b0C (All versions), CP-8000 MASTER MODULE WITH I/O -40/+70\u00b0C (All versions), CP-8021 MASTER MODULE (All versions), CP-8022 MASTER MODULE WITH GPRS (All versions). The component allows to activate a web server module which provides unauthenticated access to its web pages. This could allow an attacker to retrieve debug-level information from the component such as internal network topology or connected systems."
},
{
"lang": "es",
"value": "Se ha identificado una vulnerabilidad en el M\u00d3DULO MASTER CP-8000 CON E/S -25/+70\u00b0C (Todas las versiones), M\u00d3DULO MASTER CP-8000 CON E/S -40/+70\u00b0C (Todas las versiones), M\u00d3DULO MASTER CP-8021 (Todas las versiones), M\u00d3DULO MASTER CP-8022 CON GPRS (Todas las versiones). El componente permite activar un m\u00f3dulo de servidor web que proporciona acceso no autenticado a sus p\u00e1ginas web. Esto podr\u00eda permitir a un atacante recuperar informaci\u00f3n a nivel de depuraci\u00f3n del componente, como la topolog\u00eda de la red interna o los sistemas conectados"
}
],
"id": "CVE-2021-46304",
"lastModified": "2024-11-21T06:33:50.907",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-08-10T12:15:11.567",
"references": [
{
"source": "productcert@siemens.com",
"tags": [
"Vendor Advisory"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-185638.pdf"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-185638.pdf"
}
],
"sourceIdentifier": "productcert@siemens.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-284"
}
],
"source": "productcert@siemens.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.