CVE-2021-27388 Missing authorization in SINAMICS Medium Voltage Products, Remote Access
Unauthenticated attackers can cause denial of service or modify configuration and control commands in SINAMICS Medium Voltage products via Sm@rtServer.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-27388?
CVE-2021-27388 is a critical missing authorization vulnerability in SINAMICS Medium Voltage Products, Remote Access, published on 15 Jun 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SINAMICS medium voltage routable products are affected by a vulnerability in the Sm@rtServer component for remote access that could allow an unauthenticated attacker to cause a denial-of-service condition, and/or execution of limited configuration modifications and/or execution of limited control commands on the SINAMICS Medium Voltage Products, Remote Access (SINAMICS SL150: All versions, SINAMICS SM150: All versions, SINAMICS SM150i: All versions).
Weakness: CWE-20
Which versions are affected by CVE-2021-27388?
It affects 3 products.
Products include Siemens Sinamics Sl150 Firmware, Siemens Sinamics Sm150 Firmware, Siemens Sinamics Sm150i Firmware.
How do I fix CVE-2021-27388?
No fix has been published for CVE-2021-27388 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-27388 being exploited?
There is no known exploitation of CVE-2021-27388 in the wild and no public exploit code.
Other vulnerabilities in SINAMICS Medium Voltage Products, Remote Access
Sources
Also known as GHSA-78x7-234w-r2hv.