CVE-2021-37195CWE-80

CVE-2021-37195: vulnerability in Siemens COMOS V10.2

Published · Updated

Follow this CVE+ Monitor COMOS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 0.5%
A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 only if web components are used), COMOS V10.4 (All versions < V10.4.1 only if web components are used). The COMOS Web component of COMOS accepts arbitrary code as attachment to tasks. This could allow an attacker to inject malicious code that is executed when loading the attachment.
Affected products
Siemens · COMOS V10.2Siemens · COMOS V10.3Siemens · COMOS V10.4
Related CVEs — Siemens COMOS V10.2

In the same product, most dangerous first.

CVE-2021-37194—CVE-2021-37194EPSS 0.8%CVE-2021-37197—CVE-2021-37197EPSS 0.8%CVE-2023-24482CRITICALCVE-2023-24482EPSS 0.8%CVE-2021-37196—CVE-2021-37196EPSS 0.8%CVE-2021-37198HIGHCVE-2021-37198EPSS 0.4%CVE-2024-49704MEDIUMCVE-2024-49704EPSS 0.2%