CVE-2021-40354 Missing authorization in Teamcenter V12.4

What is CVE-2021-40354?

CVE-2021-40354 is a high-severity missing authorization vulnerability in Siemens Teamcenter Visualization, published on 14 Sep 2021. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.8), Teamcenter V13.0 (All versions < V13.0.0.7), Teamcenter V13.1 (All versions < V13.1.0.5), Teamcenter V13.2 (All versions < 13.2.0.2). The "surrogate" functionality on the user profile of the application does not perform sufficient access control that could lead to an account takeover. Any profile on the application can perform this attack and access any other user assigned tasks via the "inbox/surrogate tasks".

Weakness: CWE-269, CWE-267

Which versions are affected by CVE-2021-40354?

It affects 1 product.

Products include Siemens Teamcenter Visualization.

How do I fix CVE-2021-40354?

No fix has been published for CVE-2021-40354 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2021-40354 being exploited?

There is no known exploitation of CVE-2021-40354 in the wild and no public exploit code.

Other vulnerabilities in Siemens Teamcenter Visualization

• CVE-2021-40355 Missing authorization in Teamcenter V12.4 High 8.8
• CVE-2021-40356 XML external entity in Teamcenter V12.4 High 7.5
• CVE-2025-32454 Memory corruption in Teamcenter Visualization V14.3 High 7.3
• CVE-2025-23396 Memory corruption in Teamcenter Visualization V14.3 High 7.3
• CVE-2025-23397 Memory corruption in Teamcenter Visualization V14.3 High 7.3

All Siemens Teamcenter Visualization vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-xcq8-3527-6285.