正文

siemens 6md85_firmware 输入验证不恰当

admin
admin V管理员 /0 评论 /11 阅读
0417
此篇文章发布距今已超过1117天，您需要注意文章的内容或图片是否可用！

CVE编号

CVE-2021-41769

利用情况

暂无

补丁情况

N/A

披露时间

2022-01-11
漏洞描述
A vulnerability has been identified in SIPROTEC 5 6MD85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 6MD86 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 6MD89 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 6MU85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7KE85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SA82 devices (CPU variant CP100) (All versions < V8.83), SIPROTEC 5 7SA86 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SA87 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SD82 devices (CPU variant CP100) (All versions < V8.83), SIPROTEC 5 7SD86 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SD87 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SJ81 devices (CPU variant CP100) (All versions < V8.83), SIPROTEC 5 7SJ82 devices (CPU variant CP100) (All versions < V8.83), SIPROTEC 5 7SJ85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SJ86 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SK82 devices (CPU variant CP100) (All versions < V8.83), SIPROTEC 5 7SK85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SL82 devices (CPU variant CP100) (All versions < V8.83), SIPROTEC 5 7SL86 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SL87 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SS85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7ST85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7SX85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7UM85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7UT82 devices (CPU variant CP100) (All versions < V8.83), SIPROTEC 5 7UT85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7UT86 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7UT87 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7VE85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 7VK87 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 Compact 7SX800 devices (CPU variant CP050) (All versions < V8.83). An improper input validation vulnerability in the web server could allow an unauthenticated user to access device information.
解决建议
建议您更新当前系统或软件至最新版，完成漏洞的修复。
参考链接
https://cert-portal.siemens.com/productcert/pdf/ssa-439673.pdf
受影响软件情况
# 类型 厂商 产品 版本 影响面
1
运行在以下环境
系统 siemens 6md85_firmware * Up to
(excluding)
8.83
运行在以下环境
系统 siemens 6md86_firmware * Up to
(excluding)
8.83
运行在以下环境
系统 siemens 6md89_firmware * Up to
(excluding)
8.83
运行在以下环境
系统 siemens 6mu85_firmware * Up to
(excluding)
8.83
运行在以下环境
系统 siemens 7ke85_firmware * Up to
(excluding)
8.83
运行在以下环境
系统 siemens 7sa82_firmware * Up to
(excluding)
8.83
运行在以下环境
系统 siemens 7sa86_firmware * Up to
(excluding)
8.83
运行在以下环境
系统 siemens 7sa87_firmware * Up to
(excluding)
8.83
运行在以下环境
系统 siemens 7sd82_firmware * Up to
(excluding)
8.83
运行在以下环境
系统 siemens 7sd86_firmware * Up to
(excluding)
8.83
运行在以下环境
系统 siemens 7sd87_firmware * Up to
(excluding)
8.83
运行在以下环境
系统 siemens 7sj81_firmware * Up to
(excluding)
8.83
运行在以下环境
系统 siemens 7sj82_firmware * Up to
(excluding)
8.83
运行在以下环境
系统 siemens 7sj85_firmware * Up to
(excluding)
8.83
运行在以下环境
系统 siemens 7sj86_firmware * Up to
(excluding)
8.83
运行在以下环境
系统 siemens 7sk82_firmware * Up to
(excluding)
8.83
运行在以下环境
系统 siemens 7sk85_firmware * Up to
(excluding)
8.83
运行在以下环境
系统 siemens 7sl82_firmware * Up to
(excluding)
8.83
运行在以下环境
系统 siemens 7sl86_firmware * Up to
(excluding)
8.83
运行在以下环境
系统 siemens 7sl87_firmware * Up to
(excluding)
8.83
运行在以下环境
系统 siemens 7ss85_firmware * Up to
(excluding)
8.83
运行在以下环境
系统 siemens 7st85_firmware * Up to
(excluding)
8.83
运行在以下环境
系统 siemens 7sx800_firmware * Up to
(excluding)
8.83
运行在以下环境
系统 siemens 7sx85_firmware * Up to
(excluding)
8.83
运行在以下环境
系统 siemens 7um85_firmware * Up to
(excluding)
8.83
运行在以下环境
系统 siemens 7ut82_firmware * Up to
(excluding)
8.83
运行在以下环境
系统 siemens 7ut85_firmware * Up to
(excluding)
8.83
运行在以下环境
系统 siemens 7ut86_firmware * Up to
(excluding)
8.83
运行在以下环境
系统 siemens 7ut87_firmware * Up to
(excluding)
8.83
运行在以下环境
系统 siemens 7ve85_firmware * Up to
(excluding)
8.83
运行在以下环境
系统 siemens 7vk87_firmware * Up to
(excluding)
8.83
运行在以下环境
硬件 siemens 6md85 - -
运行在以下环境
硬件 siemens 6md86 - -
运行在以下环境
硬件 siemens 6md89 - -
运行在以下环境
硬件 siemens 6mu85 - -
运行在以下环境
硬件 siemens 7ke85 - -
运行在以下环境
硬件 siemens 7sa82 - -
运行在以下环境
硬件 siemens 7sa86 - -
运行在以下环境
硬件 siemens 7sa87 - -
运行在以下环境
硬件 siemens 7sd82 - -
运行在以下环境
硬件 siemens 7sd86 - -
运行在以下环境
硬件 siemens 7sd87 - -
运行在以下环境
硬件 siemens 7sj81 - -
运行在以下环境
硬件 siemens 7sj82 - -
运行在以下环境
硬件 siemens 7sj85 - -
运行在以下环境
硬件 siemens 7sj86 - -
运行在以下环境
硬件 siemens 7sk82 - -
运行在以下环境
硬件 siemens 7sk85 - -
运行在以下环境
硬件 siemens 7sl82 - -
运行在以下环境
硬件 siemens 7sl86 - -
运行在以下环境
硬件 siemens 7sl87 - -
运行在以下环境
硬件 siemens 7ss85 - -
运行在以下环境
硬件 siemens 7st85 - -
运行在以下环境
硬件 siemens 7sx800 - -
运行在以下环境
硬件 siemens 7sx85 - -
运行在以下环境
硬件 siemens 7um85 - -
运行在以下环境
硬件 siemens 7ut82 - -
运行在以下环境
硬件 siemens 7ut85 - -
运行在以下环境
硬件 siemens 7ut86 - -
运行在以下环境
硬件 siemens 7ut87 - -
运行在以下环境
硬件 siemens 7ve85 - -
运行在以下环境
硬件 siemens 7vk87 - -
CVSS3评分 7.5
  • 攻击路径 网络
  • 攻击复杂度 低
  • 权限要求 无
  • 影响范围 未更改
  • 用户交互 无
  • 可用性 无
  • 保密性 高
  • 完整性 无
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CWE-ID 漏洞类型 CWE-20 输入验证不恰当