CVE-2021-40366

HighCVSS 7.4/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in Climatix POL909 (AWB module) (All versions < V11.42), Climatix POL909 (AWM module) (All versions < V11.34). The web server of affected devices transmits data without TLS encryption. This could allow an unauthenticated remote attacker in a man-in-the-middle position to read sensitive data, such as administrator credentials, or modify data in transit.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-311 CWE-319

Affected software

Vendor	Product	Versions
Siemens	Climatix POL909 (AWB module)	All versions < V11.42
Siemens	Climatix POL909 (AWM module)	All versions < V11.34

References

https://cert-portal.siemens.com/productcert/pdf/ssa-703715.pdfVendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-703715.pdfVendor Advisory

Timeline

Published: Nov 9, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-403677.8A vulnerability has been identified in syngo fastView (All versions). The affected application lacks proper validation of user-supplied data CVE-2021-403687.5A vulnerability has been identified in SIMATIC S7-400 CPU 412-1 DP V7 (All versions), SIMATIC S7-400 CPU 412-2 DP V7 (All versions), SIMA CVE-2021-403696.1A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the Denounce plugin, which could CVE-2021-40374.4A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create files fo CVE-2021-403719.8Gridpro Request Management for Windows Azure Pack before 2.0.7912 allows Directory Traversal for remote code execution, as demonstrated by .CVE-2021-403739.8playSMS before 1.4.5 allows Arbitrary Code Execution by entering PHP code at the #tabs-information-page of core_main_config, and then execut CVE-2021-403745.4A stored cross-site scripting (XSS) vulnerability was identified in Apperta Foundation OpenEyes 3.5.1. Updating a patient's details allows r CVE-2021-403756.5Apperta Foundation OpenEyes 3.5.1 allows remote attackers to view the sensitive information of patients without having the intended level of CVE-2021-403767.8otris Update Manager 1.2.1.0 allows local users to achieve SYSTEM access via unauthenticated calls to exposed interfaces over a .NET named p CVE-2021-403775.4SmarterTools SmarterMail 16.x before build 7866 has stored XSS. The application fails to sanitize email content, thus allowing one to inject CVE-2021-403788.1An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. /cgi-bin/support/killps.cgi deletes all da CVE-2021-403797.5An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. rstp://.../medias2 does not require author