CVE-2021-31893

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3), SIMATIC PDM (All versions < V9.2), SIMATIC STEP 7 V5.X (All versions < V5.6 SP2 HF3), SINAMICS STARTER (containing STEP 7 OEM version) (All versions < V5.4 HF2). The affected software contains a buffer overflow vulnerability while handling certain files that could allow a local attacker to trigger a denial-of-service condition or potentially lead to remote code execution.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120

Affected software

No affected versions have been published.

Timeline

Published: Jul 13, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-318948.8A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.X (All versions < V9.1 SP2), SIMATIC CVE-2021-318958.1A vulnerability has been identified in RUGGEDCOM i800 (All versions < V4.3.7), RUGGEDCOM i801 (All versions < V4.3.7), RUGGEDCOM i802 (All v CVE-2021-318979.8In JetBrains WebStorm before 2021.1, code execution without user confirmation was possible for untrusted projects.CVE-2021-318987.5In JetBrains WebStorm before 2021.1, HTTP requests were used instead of HTTPS.CVE-2021-318998.8In JetBrains Code With Me bundled to the compatible IDEs before version 2021.1, the client could execute code in read-only mode.CVE-2021-31909.8The async-git package before 1.13.2 for Node.js allows OS Command Injection via shell metacharacters, as demonstrated by git.reset and git.t CVE-2021-319005.3In JetBrains Code With Me bundled to the compatible IDE versions before 2021.1, a client could open a browser on a host.CVE-2021-319017.5In JetBrains Hub before 2021.1.13079, two-factor authentication wasn't enabled properly for the All Users group.CVE-2021-319027.5In JetBrains YouTrack before 2020.6.6600, access control during the exporting of issues was implemented improperly.CVE-2021-319036.1In JetBrains YouTrack before 2021.1.9819, a pull request's title was sanitized insufficiently, leading to XSS.CVE-2021-319046.1In JetBrains TeamCity before 2020.2.2, XSS was potentially possible on the test history page.CVE-2021-319057.5In JetBrains YouTrack before 2020.6.8801, information disclosure in an issue preview was possible.