CVE-2021-31891: vulnerability in Siemens Desigo CC
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 3.8%
A vulnerability has been identified in Desigo CC (All versions with OIS Extension Module), GMA-Manager (All versions with OIS running on Debian 9 or earlier), Operation Scheduler (All versions with OIS running on Debian 9 or earlier), Siveillance Control (All versions with OIS running on Debian 9 or earlier), Siveillance Control Pro (All versions). The affected application incorrectly neutralizes special elements in a specific HTTP GET request which could lead to command injection. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary code on the system with root privileges.
Affected products
Siemens · Desigo CCSiemens · GMA-ManagerSiemens · Operation SchedulerSiemens · Siveillance ControlSiemens · Siveillance Control ProRelated CVEs — Siemens Desigo CC
In the same product, most dangerous first.