CVE-2021-40358 : Security Advisory and Response

A vulnerability has been identified in SIMATIC PCS 7 and SIMATIC WinCC products by Siemens. The issue could allow an attacker to perform unauthorized file operations on the web server, potentially leading to the manipulation or deletion of critical files.

Understanding CVE-2021-40358

This section provides a detailed analysis of the vulnerability.

What is CVE-2021-40358?

The vulnerability in SIMATIC PCS 7 and SIMATIC WinCC products arises from improper handling of special elements in the pathname, which could result in resolving to a location outside the intended directory on the server. This could enable unauthorized access to critical files.

The Impact of CVE-2021-40358

The vulnerability poses a critical threat with a CVSS base score of 9.9, categorizing it as a critical issue. If exploited, an attacker could potentially read, write, or delete crucial files on the affected systems.

Technical Details of CVE-2021-40358

Explore the technical aspects of the vulnerability.

Vulnerability Description

The flaw allows for the manipulation of file paths, leading to unauthorized access and modification of critical files on the web server of the impacted systems.

Affected Systems and Versions

The following Siemens products and versions are affected by the CVE-2021-40358 vulnerability:

SIMATIC PCS 7 V8.2 (All versions)
SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC04)
SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1)
SIMATIC WinCC V15 and earlier (All versions < V15 SP1 Update 7)
SIMATIC WinCC V16 (All versions < V16 Update 5)
SIMATIC WinCC V17 (All versions < V17 Update 2)
SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 19)
SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 5)

Exploitation Mechanism

The vulnerability can be exploited by crafting and submitting specially designed requests to the web server, causing it to resolve file paths outside the designated directory.

Mitigation and Prevention

Learn about the steps to mitigate the risks associated with CVE-2021-40358.

Immediate Steps to Take

To enhance security, consider the following immediate actions:

Apply security patches provided by Siemens.
Restrict access to the web server to authorized personnel only.
Monitor and analyze file operations on the servers for any suspicious activities.

Long-Term Security Practices

For sustained security measures, implement the following practices:

Regularly update and patch all software and firmware.
Conduct security assessments and penetration testing regularly.
Educate personnel on security best practices and awareness.

Patching and Updates

Siemens has released patches to address the vulnerability. Ensure all affected systems are updated with the latest security fixes to mitigate the risk of exploitation.