CVE-2021-37195 : What You Need to Know

A vulnerability has been identified in COMOS V10.2, V10.3, and V10.4 where the COMOS Web component accepts arbitrary code as attachments to tasks, potentially leading to the execution of malicious code by an attacker.

Understanding CVE-2021-37195

This CVE affects Siemens' COMOS versions V10.2, V10.3, and V10.4 when web components are used.

What is CVE-2021-37195?

The vulnerability allows attackers to inject malicious code as attachments to tasks within the COMOS Web component, posing a risk of executing unauthorized code.

The Impact of CVE-2021-37195

Exploitation of this vulnerability can result in the execution of arbitrary code by an attacker, potentially leading to system compromise or unauthorized access to sensitive information.

Technical Details of CVE-2021-37195

This section outlines specific technical aspects of the vulnerability.

Vulnerability Description

The vulnerability in COMOS V10.2, V10.3, and V10.4 allows for the acceptance of arbitrary code attachments within tasks through the COMOS Web component.

Affected Systems and Versions

COMOS V10.2 (All versions only if web components are used) COMOS V10.3 (All versions < V10.3.3.3 only if web components are used) COMOS V10.4 (All versions < V10.4.1 only if web components are used)

Exploitation Mechanism

Attackers can exploit this vulnerability by injecting malicious code into task attachments, which may execute when loading the attachment.

Mitigation and Prevention

To address CVE-2021-37195, users and organizations should take immediate and long-term security measures to mitigate risks and prevent exploitation of the vulnerability.

Immediate Steps to Take

Update to the latest unaffected versions of COMOS if using web components.
Implement network-level security controls to restrict unauthorized access.

Long-Term Security Practices

Regularly monitor for security updates from Siemens and apply patches promptly.
Implement secure coding practices to prevent injection attacks.

Patching and Updates

Consult Siemens' security advisories and apply recommended patches to secure affected systems from potential exploits.