CVE-2021-40364

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC04), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMATIC WinCC V15 and earlier (All versions < V15 SP1 Update 7), SIMATIC WinCC V16 (All versions < V16 Update 5), SIMATIC WinCC V17 (All versions < V17 Update 2), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 19), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 5). The affected systems store sensitive information in log files. An attacker with access to the log files could publicly expose the information or reuse it to develop further attacks on the system.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-532

Affected software

Vendor	Product	Versions
Siemens	SIMATIC PCS 7 V8.2	All versions
Siemens	SIMATIC PCS 7 V9.0	All versions < V9.0 SP3 UC04
Siemens	SIMATIC PCS 7 V9.1	All versions < V9.1 SP1
Siemens	SIMATIC WinCC V15 and earlier	All versions < V15 SP1 Update 7
Siemens	SIMATIC WinCC V16	All versions < V16 Update 5
Siemens	SIMATIC WinCC V17	All versions < V17 Update 2
Siemens	SIMATIC WinCC V7.4	All versions < V7.4 SP1 Update 19
Siemens	SIMATIC WinCC V7.5	All versions < V7.5 SP2 Update 5

References

https://cert-portal.siemens.com/productcert/pdf/ssa-840188.pdfVendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-840188.pdfVendor Advisory

Timeline

Published: Nov 9, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-403657.5Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a deni CVE-2021-403667.4A vulnerability has been identified in Climatix POL909 (AWB module) (All versions < V11.42), Climatix POL909 (AWM module) (All versions < V1 CVE-2021-403677.8A vulnerability has been identified in syngo fastView (All versions). The affected application lacks proper validation of user-supplied data CVE-2021-403687.5A vulnerability has been identified in SIMATIC S7-400 CPU 412-1 DP V7 (All versions), SIMATIC S7-400 CPU 412-2 DP V7 (All versions), SIMA CVE-2021-403696.1A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the Denounce plugin, which could CVE-2021-40374.4A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create files fo CVE-2021-403719.8Gridpro Request Management for Windows Azure Pack before 2.0.7912 allows Directory Traversal for remote code execution, as demonstrated by .CVE-2021-403739.8playSMS before 1.4.5 allows Arbitrary Code Execution by entering PHP code at the #tabs-information-page of core_main_config, and then execut CVE-2021-403745.4A stored cross-site scripting (XSS) vulnerability was identified in Apperta Foundation OpenEyes 3.5.1. Updating a patient's details allows r CVE-2021-403756.5Apperta Foundation OpenEyes 3.5.1 allows remote attackers to view the sensitive information of patients without having the intended level of CVE-2021-403767.8otris Update Manager 1.2.1.0 allows local users to achieve SYSTEM access via unauthenticated calls to exposed interfaces over a .NET named p CVE-2021-403775.4SmarterTools SmarterMail 16.x before build 7866 has stored XSS. The application fails to sanitize email content, thus allowing one to inject