V
Scaner-VS
HomeCatalogSourcesCWECAPECATT&CKMitigationsProductsVendorsDocs
CVE-2021-27384
CVE
Critical

A vulnerability has been identified in SIMATIC HMI Comfort Outdoor Panels V15 7\" & 15\" (incl. SIPLUS variants) (All versions < V15.1 Upda…

CVSS
9.8
Critical
EPSS
0.03
p82
Published
2021-01-01
Updated
2021-01-01
Description

A vulnerability has been identified in SIMATIC HMI Comfort Outdoor Panels V15 7\" & 15\" (incl. SIPLUS variants) (All versions < V15.1 Update 6), SIMATIC HMI Comfort Outdoor Panels V16 7\" & 15\" (incl. SIPLUS variants) (All versions < V16 Update 4), SIMATIC HMI Comfort Panels V15 4\" - 22\" (incl. SIPLUS variants) (All versions < V15.1 Update 6), SIMATIC HMI Comfort Panels V16 4\" - 22\" (incl. SIPLUS variants) (All versions < V16 Update 4), SIMATIC HMI KTP Mobile Panels V15 KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions < V15.1 Update 6), SIMATIC HMI KTP Mobile Panels V16 KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions < V16 Update 4), SIMATIC WinCC Runtime Advanced V15 (All versions < V15.1 Update 6), SIMATIC WinCC Runtime Advanced V16 (All versions < V16 Update 4), SINAMICS GH150 (All versions), SINAMICS GL150 (with option X30) (All versions), SINAMICS GM150 (with option X30) (All versions), SINAMICS SH150 (All versions), SINAMICS SL150 (All versions), SINAMICS SM120 (All versions), SINAMICS SM150 (All versions), SINAMICS SM150i (All versions). SmartVNC has an out-of-bounds memory access vulnerability in the device layout handler, represented by a binary data stream on client side, which can potentially result in code execution.

Tags · CWE
Pre-auth
CWE-788
Affected products
Simatic_wincc_runtime_advanced < 16Simatic_wincc_runtime_advanced
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Timeline
2021-01-01
Published
2021-01-01
Updated
CVSS 3.1 breakdown
Attack Vector
AV: N
Network (N)
Attack Complexity
AC: L
Low (L)
Privileges Required
PR: N
None (N)
User Interaction
UI: N
None (N)
Scope
S: U
Unchanged (U)
Confidentiality Impact
C: H
High (H)
Integrity Impact
I: H
High (H)
Availability Impact
A: H
High (H)
Exploit indicators
EPSS
0.025 · p82
Known exploited (KEV)
No
Known exploits — Сканер-ВС
No Сканер-ВС checks registered for this vulnerability yet.
Affected products
ProductVendorStatus
simatic_hmi_comfort_outdoor_panels_15"_firmware*Tracked
simatic_hmi_comfort_outdoor_panels_15"_firmware*Tracked
simatic_hmi_comfort_outdoor_panels_7"_firmware*Tracked
simatic_hmi_comfort_outdoor_panels_7"_firmware*Tracked
simatic_hmi_comfort_panels_22"_firmware*Tracked
simatic_hmi_comfort_panels_22"_firmware*Tracked
simatic_hmi_comfort_panels_4"_firmware*Tracked
simatic_hmi_comfort_panels_4"_firmware*Tracked
simatic_hmi_ktp_mobile_panels_ktp400f_firmware*Tracked
simatic_hmi_ktp_mobile_panels_ktp400f_firmware*Tracked
simatic_hmi_ktp_mobile_panels_ktp700_firmware*Tracked
simatic_hmi_ktp_mobile_panels_ktp700_firmware*Tracked
simatic_hmi_ktp_mobile_panels_ktp700f_firmware*Tracked
simatic_hmi_ktp_mobile_panels_ktp700f_firmware*Tracked
simatic_hmi_ktp_mobile_panels_ktp900_firmware*Tracked
simatic_hmi_ktp_mobile_panels_ktp900_firmware*Tracked
simatic_hmi_ktp_mobile_panels_ktp900f_firmware*Tracked
simatic_hmi_ktp_mobile_panels_ktp900f_firmware*Tracked
simatic_wincc_runtime_advanced*Tracked
simatic_wincc_runtime_advanced*Tracked
Showing first 20 of 28
Source databases
CVE
Related vulnerabilities