CVE-2021-31894

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.X (All versions < V9.1 SP2), SIMATIC PDM (All versions < V9.2 SP2), SIMATIC STEP 7 V5.X (All versions < V5.7), SINAMICS STARTER (containing STEP 7 OEM version) (All versions < V5.4 SP2 HF1). A directory containing metafiles relevant to devices' configurations has write permissions. An attacker could leverage this vulnerability by changing the content of certain metafiles and subsequently manipulate parameters or behavior of devices that would be later configured by the affected software.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-732

Affected software

No affected versions have been published.

Timeline

Published: Jul 13, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-318958.1A vulnerability has been identified in RUGGEDCOM i800 (All versions < V4.3.7), RUGGEDCOM i801 (All versions < V4.3.7), RUGGEDCOM i802 (All v CVE-2021-318979.8In JetBrains WebStorm before 2021.1, code execution without user confirmation was possible for untrusted projects.CVE-2021-318987.5In JetBrains WebStorm before 2021.1, HTTP requests were used instead of HTTPS.CVE-2021-318998.8In JetBrains Code With Me bundled to the compatible IDEs before version 2021.1, the client could execute code in read-only mode.CVE-2021-31909.8The async-git package before 1.13.2 for Node.js allows OS Command Injection via shell metacharacters, as demonstrated by git.reset and git.t CVE-2021-319005.3In JetBrains Code With Me bundled to the compatible IDE versions before 2021.1, a client could open a browser on a host.CVE-2021-319017.5In JetBrains Hub before 2021.1.13079, two-factor authentication wasn't enabled properly for the All Users group.CVE-2021-319027.5In JetBrains YouTrack before 2020.6.6600, access control during the exporting of issues was implemented improperly.CVE-2021-319036.1In JetBrains YouTrack before 2021.1.9819, a pull request's title was sanitized insufficiently, leading to XSS.CVE-2021-319046.1In JetBrains TeamCity before 2020.2.2, XSS was potentially possible on the test history page.CVE-2021-319057.5In JetBrains YouTrack before 2020.6.8801, information disclosure in an issue preview was possible.CVE-2021-319062.7In JetBrains TeamCity before 2020.2.2, audit logs were not sufficient when an administrator uploaded a file.