CVE-2021-45034
HIGHSiemens Cp-8000 Master Module With I/... - Improper Access Control
Title source: ruleDescription
A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions < V16.20), CP-8000 MASTER MODULE WITH I/O -40/+70°C (All versions < V16.20), CP-8021 MASTER MODULE (All versions < V16.20), CP-8022 MASTER MODULE WITH GPRS (All versions < V16.20). The web server of the affected system allows access to logfiles and diagnostic data generated by a privileged user. An unauthenticated attacker could access the files by knowing the corresponding download links.
References (3)
Core 3
Core References
Patch, Vendor Advisory x_refsource_misc
https://cert-portal.siemens.com/productcert/pdf/ssa-324998.pdf
Exploit, Mailing List, Third Party Advisory mailing-list
x_refsource_fulldisc
http://seclists.org/fulldisclosure/2022/Apr/20
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
http://packetstormsecurity.com/files/166743/Siemens-A8000-CP-8050-CP-8031-SICAM-WEB-Missing-File-Download-Missing-Authentication.html
Scores
CVSS v3
7.5
EPSS
0.0063
EPSS Percentile
70.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Details
CWE
CWE-284
CWE-532
Status
published
Products (4)
siemens/cp-8000_master_module_with_i\/o_-25\/\+70_firmware
< 16.20
siemens/cp-8000_master_module_with_i\/o_-40\/\+70_firmware
< 16.20
siemens/cp-8021_master_module_firmware
< 16.20
siemens/cp-8022_master_module_with_gprs_firmware
< 16.20
Published
Jan 11, 2022
Tracked Since
Feb 18, 2026